{"id":"CVE-2026-111922","summary":"Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins","details":"Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account.","aliases":["GHSA-m687-p538-r5hp","GO-2026-6739"],"modified":"2026-10-19T21:40:54.835844206Z","published":"2026-10-17T18:46:35.991Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-942"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111922.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111922.json"},{"type":"ADVISORY","url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m687-p538-r5hp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111922"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/vikunja-2.2.0-before-2.7.0-permissive-cors-policy-trusting-localhost-origins"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/go-vikunja/vikunja","events":[{"introduced":"b365be1881641dd2791d3dff4c26ad941c13cef6"},{"fixed":"a16be96aa454671fdf213b0fbe411dd38a098418"}],"database_specific":{"extracted_events":[{"introduced":"2.2.0"},{"fixed":"2.7.0"}],"source":"AFFECTED_FIELD"}}],"versions":["v2.6.0","v2.5.0","v2.4.0","v2.3.0","v2.2.2","v2.2.1","v2.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111922.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}