PT-2026-27445 · Vikunja · Vikunja

Highkolaente · CVE-2026-33668 · Published 2026-03-24 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.18.0 through 2.2.0

Description Vikunja is a self-hosted task management platform. When a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. The API tokens, CalDAV basic authentication, and OpenID Connect authentication paths do not verify user status, allowing disabled or locked users to continue accessing the API and syncing data. The vulnerable authentication paths include the use of API tokens via the /api/v1/lists endpoint, CalDAV basic authentication, and OpenID Connect. The user status is not verified during authentication via these methods.

Recommendations Update to version 2.2.1 or later.

Exploit

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

CVE-2026-33668

GHSA-94XM-JJ8X-3CR4

GO-2026-4849

OPENSUSE-SU-2026:21483-1

SUSE-SU-2026:1135-1

Affected Products

Vikunja

References · 1750

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33668.json · Exploit
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-94xm-jj8x-3cr4 · Vendor Advisory
• https://github.com/go-vikunja/vikunja/commit/fd452b9cb6457fd4f9936527a14c359818f1cca7 · Patch
• https://github.com/go-vikunja/vikunja/commit/033922309f492996c928122fb49b691339199c35 · Patch
• https://github.com/go-vikunja/vikunja/commit/04704e0fde4b027039cf583110cee7afe136fc1b · Patch
• https://github.com/go-vikunja/vikunja/commit/0b04768d830c80e9fde1b0962db1499cc652da0e · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4849 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-94xm-jj8x-3cr4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33668 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33668 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/go-vikunja/vikunja · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note