Ghostwire

CVE-2026-91981: Vikunja: Link-share token can enumerate users through the v2 API

MEDIUM CVSS 0.0 EPSS 0.31% Exploit Available 1 PoC

Published: October 9, 2026 | Last Modified: October 9, 2026

Description

Vikunja: Link-share token can enumerate users through the v2 API

Ghostwire Analysis — What This Means Practically

Exploitation Probability (EPSS): Low — 0.31% (22th percentile)

Low exploitation probability based on current threat landscape data. Standard patching timeline is appropriate.

1 proof-of-concept exploit available on GitHub. Public exploit code lowers the barrier for both researchers and attackers.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

Proof-of-Concept Exploits (1)

go-vikunja/vikunja

References

github.com/go-vikunja/vikunja/security/advisories/GHSA-vfxw-3x8p-2vjr
nvd.nist.gov/vuln/detail/CVE-2026-91981
github.com/go-vikunja/vikunja/pull/3688
github.com/go-vikunja/vikunja/releases/tag/v2.6.0
www.vulncheck.com/advisories/vikunja-before-2.6.0-user-enumeration-via-v2-api
github.com/advisories/GHSA-vfxw-3x8p-2vjr
www.tenable.com/cve/CVE-2026-91981
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-91981