CVE-2026-111922: Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-17 · updated 2026-10-19
Weakness: CWE-942

Description

Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account.

Affected products

Go Code.Vikunja.Io/Api: from 2.2.0 through 2.6.0
go-vikunja vikunja: from 2.2.0 before 2.7.0 — fixed in 2.7.0

How to fix

Upgrade to a fixed version: go-vikunja vikunja 2.7.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-111922 or the next vulnerability affects your stack