Vikunja, an open‑source task management platform, issued JSON Web Tokens (JWTs) for link sharing that were created solely from the JWT claims without any server‑side verification of the share’s current status. When a project owner deleted a share or lowered its permissions, the tokens that had already been handed out continued to grant the original level of access for the full 72‑hour default token lifetime, allowing an attacker or an inadvertently privileged user to view, edit, or otherwise interact with data that should have been inaccessible. The effect is a breach of confidentiality and integrity for the resources linked via the share. The weakness is classified as CWE‑613 (Failure to Validate The Scope of Access).

The vulnerability affects the Vikunja task management platform, version 2.2.x and older – any deployment running a release prior to 2.3.0 is susceptible. As Vikunja is typically self‑hosted, operators of any instance using the affected code are impacted, regardless of the hosting environment.

The CVSS score of 6.5 places the issue in the medium severity range, and the lack of an EPSS score indicates no publicly available data on exploit frequency. The issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Because the vulnerability is triggered by the continued validity of already issued JWTs, an attacker could exploit it by merely retrieving a previously distributed link share URL or by capturing a token in transit. The likely attack vector is over the network via the share link, and the prerequisite is possession of an existing JWT that was issued before the share was revoked or its permissions altered.