Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123493Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens
Medium 5.4
In plain English
A medium-severity security flaw in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading and modifying shared projects via the HTTP API, CalDAV, MCP and feeds.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 2.4.0 – before 2.7.1 |
Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
References
- GitHub Security Advisory (GHSA-5fc2-w2j4-6r8w) vendor-advisory
- VulnCheck Advisory: Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens third-party-advisory