CVE-2026-33668

HIGH

Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect

Title source: cna
STIX 2.1

Description

Vikunja is an open-source self-hosted task management platform. Starting in version 0.18.0 and prior to version 2.2.1, when a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. Three other authentication paths — API tokens, CalDAV basic auth, and OpenID Connect — do not verify user status, allowing disabled or locked users to continue accessing the API and syncing data. Version 2.2.1 patches the issue.

References (6)

Core 6
Core References

Scores

CVSS v3 8.1
EPSS 0.0045
EPSS Percentile 35.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-285 CWE-863
Status published
Products (3)
code.vikunja.io/api 0.18.0 - 2.2.1Go
go-vikunja/vikunja >= 0.18.0, < 2.2.1
vikunja/vikunja 0.18.0 - 2.2.1
Published Mar 24, 2026
Tracked Since Mar 24, 2026