CVE-2026-123493Medium· 5.4▾ SunlitVikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status,…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading and modifying shared projects via the HTTP API, CalDAV, MCP and feeds.
vikunja >= 2.4.0 < 2.7.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123528Medium· 6.8Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware
CVE-2026-123494Low· 3.5Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks
CVE-2026-123495Medium· 4.6Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback
CVE-2026-123498Low· 3.7Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata
CVE-2026-123497Medium· 6.8Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery
CVE-2026-123496Low· 3.3Vikunja veans before 2.7.1 Symlink Following in veans init