PT-2026-27445 · Vikunja · Vikunja

Highkolaente · Publicado 2026-03-24 · Atualizado 2026-03-27 · CVE-2026-33668

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.18.0 through 2.2.0

Description Vikunja is a self-hosted task management platform. When a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. The API tokens, CalDAV basic authentication, and OpenID Connect authentication paths do not verify user status, allowing disabled or locked users to continue accessing the API and syncing data. The vulnerable authentication paths include the use of API tokens via the /api/v1/lists endpoint, CalDAV basic authentication, and OpenID Connect. The user status is not verified during authentication via these methods.

Recommendations Update to version 2.2.1 or later.

Exploit

Correção

Improper Authorization

Incorrect Authorization

Enumeração de Fraquezas

CWE-285

CWE-863

Identificadores relacionados

CVE-2026-33668

GHSA-94XM-JJ8X-3CR4

GO-2026-4849

SUSE-SU-2026:1135-1

Produtos afetados

Vikunja

Referências · 153

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33668.json · Exploit
• https://github.com/go-vikunja/vikunja · Nota
• https://github.com/go-vikunja/vikunja/commit/fd452b9cb6457fd4f9936527a14c359818f1cca7 · Correção
• https://github.com/go-vikunja/vikunja/commit/033922309f492996c928122fb49b691339199c35 · Correção
• https://github.com/go-vikunja/vikunja/commit/0b04768d830c80e9fde1b0962db1499cc652da0e · Correção
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-94xm-jj8x-3cr4 · Aviso do Fabricante
• https://github.com/go-vikunja/vikunja/commit/04704e0fde4b027039cf583110cee7afe136fc1b · Correção
• https://suse.com/security/cve/CVE-2026-32750 · Nota
• https://suse.com/security/cve/CVE-2026-33678 · Nota
• https://suse.com/security/cve/CVE-2026-33525 · Nota
• https://suse.com/security/cve/CVE-2026-2578 · Nota
• https://suse.com/security/cve/CVE-2026-32301 · Nota
• https://suse.com/security/cve/CVE-2026-32694 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-33668 · Nota de Segurança
• https://suse.com/security/cve/CVE-2026-32828 · Nota