{"cve":"CVE-2026-57458","nvd":{"published":"2026-10-09T21:17:05.190","modified":"2026-10-16T20:04:29.760","status":"Deferred","description":"Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange the code at `POST /api/v1/oauth/token` for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API token's permissions, allowing access to routes outside its declared scope for the same user. Version 2.4.0 fixes the vulnerability.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1},"cwes":["CWE-269"],"references":["https://github.com/go-vikunja/vikunja/commit/4ae2e093014881052ed8f8ecd8bcb9adf83dd276","https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0","https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v3p6-34mc-hj7v","https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v3p6-34mc-hj7v"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:58:01.639778232+00:00"},"epss":{"cve":"CVE-2026-57458","score":0.0033,"percentile":0.25925,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-v3p6-34mc-hj7v","url":"https://osv.dev/vulnerability/GHSA-v3p6-34mc-hj7v","summary":"Vikunja: Scoped API token can mint unrestricted OAuth session credentials","modified":"2026-10-19T21:40:52.432452993Z","packages":[{"ecosystem":"Go","name":"code.vikunja.io/api","purl":"pkg:golang/code.vikunja.io/api","ranges":[">=2.3.0 <2.4.0"],"fixed":["2.4.0"]}]},{"id":"GO-2026-6750","url":"https://osv.dev/vulnerability/GO-2026-6750","summary":"Vikunja: Scoped API token can mint unrestricted OAuth session credentials in code.vikunja.io/api","modified":"2026-10-19T21:31:50.563746927Z","packages":[{"ecosystem":"Go","name":"code.vikunja.io/api","purl":"pkg:golang/code.vikunja.io/api","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}