Vikunja · Vikunja · CVE-2026-33668
**Name of the Vulnerable Software and Affected Versions**
Vikunja versions 0.18.0 through 2.2.0
**Description**
Vikunja is a self-hosted task management platform. When a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. The API tokens, CalDAV basic authentication, and OpenID Connect authentication paths do not verify user status, allowing disabled or locked users to continue accessing the API and syncing data. The vulnerable authentication paths include the use of API tokens via the `/api/v1/lists` endpoint, CalDAV basic authentication, and OpenID Connect. The `user status` is not verified during authentication via these methods.
**Recommendations**
Update to version 2.2.1 or later.