A scoped API token with only oauth.authorize permission in Vikunja can be used to obtain an OAuth authorization code. That code can then be exchanged for a bearer JSON Web Token and refresh token that are not limited by the original token’s scope. The resulting credentials allow unrestricted access to all routes available to the owning user, effectively turning a low‑privilege token into a full session. The flaw stems from improper privilege delegation (CWE‑269).

The affected product is the Vikunja self‑hosted task management platform. Versions 2.3.0 and any earlier releases that have not applied the 2.4.0 patch contain the vulnerability. Running a patched version of 2.4.0 or later eliminates the risk.

The CVSS score of 8.1 signals a high severity vulnerability. The EPSS score is not available, but the flaw requires only the possession of a legitimate scoped API token, which can be acquired via normal API usage, social engineering, or compromised user credentials. The issue is not listed in the CISA KEV catalog. The most likely attack vector is through legitimate API calls by an attacker who obtains such a scoped token, then swapping the token for a full OAuth session to access sensitive data and administrative functionality.