CVE-2026-57458

Summary

A scoped API token with only 'oauth.authorize' permission can bypass authorization controls to obtain full user access tokens, allowing privilege escalation through OAuth flows. This means attackers with limited API access can gain complete user privileges.

Exploitability

Moderately difficult to exploit as it requires having a valid scoped API token with oauth.authorize permission, but the attack chain is straightforward once that precondition is met.

Blast radius

The vulnerability affects all users who have any scoped API tokens with the oauth.authorize permission, potentially allowing attackers to access sensitive user data and perform unauthorized actions across the entire Vikunja platform.

Detection

Monitor for POST /api/v1/oauth/authorize and POST /api/v1/oauth/token API calls that originate from scoped API tokens with oauth.authorize permissions, particularly when followed by access to restricted user resources.

Prioritized remediation

Upgrade to Vikunja version 2.4.0 or later to fix the authorization bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.