PT-2026-26753 · Vikunja · Vikunja

Vashuvats · Published 2026-03-20 · Updated 2026-03-27 · CVE-2026-33316

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vikunja (affected versions not specified)

Description A flaw in the password reset logic allows disabled users to regain access to their accounts. The ResetPassword() function sets the user’s status to StatusActive after a successful password reset without verifying whether the account was previously disabled. A disabled user can request a reset token via the /api/v1/user/password/token endpoint and complete the reset using the /api/v1/user/password/reset endpoint, reactivating their account and bypassing administrator-imposed account disablement. The RequestUserPasswordResetTokenByEmail function fetches the user via GetUserWithEmail(), which does not filter out disabled users, allowing them to request a token. The vulnerable code is located in pkg/user/user password reset.go, beginning at line 66, where the user.Status is unconditionally set to StatusActive.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Missing Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-862

CWE-284

Related Identifiers

CVE-2026-33316

GHSA-VQ4Q-79HH-Q767

GO-2026-4798

SUSE-SU-2026:1135-1

Affected Products

Vikunja

References · 153

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33316.json · Exploit
• https://github.com/go-vikunja/vikunja/commit/d8570c603da1f26635ce6048d6af85ede827abfb · Patch
• https://github.com/go-vikunja/vikunja/commit/049f4a6be46f9460bd516f489ef9f569574bc70d · Patch
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vq4q-79hh-q767 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vq4q-79hh-q767 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4798 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33316 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33316 · Vendor Advisory
• https://github.com/go-vikunja/vikunja · Note
• https://suse.com/security/cve/CVE-2026-2455 · Note
• https://suse.com/security/cve/CVE-2026-30886 · Note
• https://suse.com/security/cve/CVE-2026-32815 · Note
• https://suse.com/security/cve/CVE-2026-33505 · Note
• https://suse.com/security/cve/CVE-2026-3864 · Note