CVE-2026-57458

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57458
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57458.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57458
Aliases
Published
2026-10-09T20:46:29Z
Modified
2026-10-11T02:47:06Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Vikunja: Scoped API token can mint unrestricted OAuth session credentials
Details

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the oauth.authorize permission can call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange the code at POST /api/v1/oauth/token for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API token's permissions, allowing access to routes outside its declared scope for the same user. Version 2.4.0 fixes the vulnerability.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-269"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57458.json"
}
References

Affected packages

Git / github.com/go-vikunja/vikunja

Affected ranges

Type
GIT
Repo
https://github.com/go-vikunja/vikunja
Events
Introduced
28b537837f9808dc106c9058b5829c65759fddf2
Fixed
4ae2e093014881052ed8f8ecd8bcb9adf83dd276
Fixed
907850feae3866ae9b16ea1c7b84a4d77273415a
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "= 2.3.0"
        },
        {
            "last_affected": "= 2.3.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

= 2.*
= 2.3.0
v2.*
v2.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57458.json"