MEDIUM 5.3 NVD
CVE-2026-123493
Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned b
Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading and modifying shared projects via the HTTP API, CalDAV, MCP and feeds.
References
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-5fc2-w2j4-6r8w
- https://www.vulncheck.com/advisories/vikunja-from-2.4.0-before-2.7.1-authentication-bypass
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.