Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123530Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints
Medium 5.9
In plain English
A medium-severity missing authentication in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to enroll and enable TOTP without the account password. Attackers can call the TOTP enroll and enable endpoints with their own secret to lock the owner out, persisting even after password reset.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 0 – before 2.7.1 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
References
- GitHub Security Advisory (GHSA-h4q3-mc9r-q7vv) vendor-advisory
- VulnCheck Advisory: Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints third-party-advisory