PT-2026-27445 · Vikunja · Vikunja

Highkolaente · Published 2026-03-24 · Updated 2026-03-27 · CVE-2026-33668

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.18.0 through 2.2.0

Description Vikunja is a self-hosted task management platform. When a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. The API tokens, CalDAV basic authentication, and OpenID Connect authentication paths do not verify user status, allowing disabled or locked users to continue accessing the API and syncing data. The vulnerable authentication paths include the use of API tokens via the /api/v1/lists endpoint, CalDAV basic authentication, and OpenID Connect. The user status is not verified during authentication via these methods.

Recommendations Update to version 2.2.1 or later.

Exploit

Fix

Improper Authorization

Incorrect Authorization

Weakness Enumeration

CWE-285

CWE-863

Related Identifiers

CVE-2026-33668

GHSA-94XM-JJ8X-3CR4

GO-2026-4849

SUSE-SU-2026:1135-1

Affected Products

Vikunja

References · 153

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33668.json · Exploit
• https://github.com/go-vikunja/vikunja/commit/fd452b9cb6457fd4f9936527a14c359818f1cca7 · Patch
• https://github.com/go-vikunja/vikunja/commit/033922309f492996c928122fb49b691339199c35 · Patch
• https://github.com/go-vikunja/vikunja/commit/0b04768d830c80e9fde1b0962db1499cc652da0e · Patch
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-94xm-jj8x-3cr4 · Vendor Advisory
• https://github.com/go-vikunja/vikunja/commit/04704e0fde4b027039cf583110cee7afe136fc1b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33668 · Security Note
• https://osv.dev/vulnerability/GO-2026-4849 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-94xm-jj8x-3cr4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33668 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://github.com/go-vikunja/vikunja · Note
• https://suse.com/security/cve/CVE-2026-32750 · Note
• https://suse.com/security/cve/CVE-2026-33678 · Note
• https://suse.com/security/cve/CVE-2026-33525 · Note