Log in Start free

Vulnerability · Published Mar 24, 2026 · Assigned by GitHub_M

CVE-2026-33668Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect

High 7.1

In plain English

A high-severity incorrect authorization in vikunja from go-vikunja. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.5%top 59.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Vikunja is an open-source self-hosted task management platform. Starting in version 0.18.0 and prior to version 2.2.1, when a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. Three other authentication paths — API tokens, CalDAV basic auth, and OpenID Connect — do not verify user status, allowing disabled or locked users to continue accessing the API and syncing data. Version 2.2.1 patches the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gocode.vikunja.io/api2.2.1GHSA-94xm-jj8x-3cr4
Gocode.vikunja.io/apino fix listedGO-2026-4849

Affected products (as reported)

VendorProductVersions
go-vikunja vikunja >= 0.18.0, < 2.2.1

Weakness: CWE-285, CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References