Summary
Vikunja 2.3.0 can convert a narrowly scoped API token with only the oauth.authorize permission into a normal bearer JWT and refresh token. Because the resulting credentials do not retain the original scope, an attacker who can use such a token may access additional routes available to the same user.
Vikunja 2.3.0 can convert a narrowly scoped API token with only the oauth.authorize permission into a normal bearer JWT and refresh token. Because the resulting credentials do not retain the original scope, an attacker who can use such a token may access additional routes available to the same user.
Affected context
The issue occurs in Vikunja deployments where scoped API tokens can invoke the OAuth authorization and token-exchange flow. It becomes risky when a token restricted to oauth.authorize can obtain general bearer credentials whose permissions are evaluated independently of the originating token's scope.
The issue occurs in Vikunja deployments where scoped API tokens can invoke the OAuth authorization and token-exchange flow. It becomes risky when a token restricted to oauth.authorize can obtain general bearer credentials whose permissions are evaluated independently of the originating token's scope.
Exploit preconditions
- Attack surface: Vikunja OAuth API endpoints
- Required access: A valid scoped API token with the
oauth.authorizepermission - Trigger point: Authorization-code creation followed by token exchange at the OAuth token endpoint
- Why exploitation is possible: The issued JWT and refresh token do not preserve or enforce the source token's narrower authorization scope
- Attack surface: Vikunja OAuth API endpoints
- Required access: A valid scoped API token with the
oauth.authorizepermission - Trigger point: Authorization-code creation followed by token exchange at the OAuth token endpoint
- Why exploitation is possible: The issued JWT and refresh token do not preserve or enforce the source token's narrower authorization scope
Why this happens
The underlying flaw is an authorization-context transition that fails to preserve least-privilege constraints. A token limited to one OAuth operation can be exchanged for credentials evaluated as general user credentials, allowing access decisions to omit the restrictions attached to the original token. This behavior maps to CWE-269: Improper Privilege Management, because a lower-privileged authorization context can result in credentials with broader effective privileges.
The underlying flaw is an authorization-context transition that fails to preserve least-privilege constraints. A token limited to one OAuth operation can be exchanged for credentials evaluated as general user credentials, allowing access decisions to omit the restrictions attached to the original token. This behavior maps to CWE-269: Improper Privilege Management, because a lower-privileged authorization context can result in credentials with broader effective privileges.
Potential impact
- An attacker may access API routes outside the declared scope of the original token.
- The attacker could perform actions permitted to the associated user account.
- Sensitive user or task-management data may be exposed or modified.
- The resulting credentials may remain usable until expiration or revocation, depending on deployment controls.
- An attacker may access API routes outside the declared scope of the original token.
- The attacker could perform actions permitted to the associated user account.
- Sensitive user or task-management data may be exposed or modified.
- The resulting credentials may remain usable until expiration or revocation, depending on deployment controls.
General mitigation guidance
Mitigation generally focuses on preserving authorization context throughout token issuance and use.
Common defensive patterns include:
- Bind exchanged access and refresh tokens to the effective scope of the originating token.
- Revalidate scopes and user permissions at every authorization boundary.
- Issue only the minimum credentials required for the requested OAuth operation.
- Limit refresh-token privileges and support prompt revocation of suspicious credentials.
- Apply least-privilege permissions to user accounts, service identities, and API tokens.
- Monitor and restrict OAuth flows that produce credentials with broader privileges than their inputs.
These patterns reduce the risk of privilege expansion even when a scoped token is exposed.
Mitigation generally focuses on preserving authorization context throughout token issuance and use.
Common defensive patterns include:
- Bind exchanged access and refresh tokens to the effective scope of the originating token.
- Revalidate scopes and user permissions at every authorization boundary.
- Issue only the minimum credentials required for the requested OAuth operation.
- Limit refresh-token privileges and support prompt revocation of suspicious credentials.
- Apply least-privilege permissions to user accounts, service identities, and API tokens.
- Monitor and restrict OAuth flows that produce credentials with broader privileges than their inputs.
These patterns reduce the risk of privilege expansion even when a scoped token is exposed.
How teams detect issues like this
Organizations can look for authorization-context inconsistencies through:
- Integration tests that compare source-token scopes with scopes on issued access and refresh tokens.
- Static analysis and code review checks for token-exchange paths that construct credentials without copying or validating scope.
- API policy tests covering every OAuth endpoint and protected route.
- Audit-log correlation between scoped-token use, authorization-code issuance, and subsequent access to out-of-scope endpoints.
- Automated security review tools that flag privilege expansion and missing authorization checks.
Organizations can look for authorization-context inconsistencies through:
- Integration tests that compare source-token scopes with scopes on issued access and refresh tokens.
- Static analysis and code review checks for token-exchange paths that construct credentials without copying or validating scope.
- API policy tests covering every OAuth endpoint and protected route.
- Audit-log correlation between scoped-token use, authorization-code issuance, and subsequent access to out-of-scope endpoints.
- Automated security review tools that flag privilege expansion and missing authorization checks.
