---
id: CVE-2026-123493
title: Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens
summary: >-
  Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass
  vulnerability that allows disabled or locked users to retain access through
  API tokens owned by their bot users. Because token validation only checks the
  bot's own status,…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-613
vendor: go-vikunja
product: vikunja
affected:
  - vikunja >= 2.4.0 < 2.7.1
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:37:12.159Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123493'
references:
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-5fc2-w2j4-6r8w
    label: GitHub Security Advisory (GHSA-5fc2-w2j4-6r8w)
  - url: >-
      https://www.vulncheck.com/advisories/vikunja-from-2.4.0-before-2.7.1-authentication-bypass-via-bot-api-tokens
    label: >-
      VulnCheck Advisory: Vikunja from 2.4.0 before 2.7.1 Authentication Bypass
      via Bot API Tokens
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.708Z'
---

## Overview

Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading and modifying shared projects via the HTTP API, CalDAV, MCP and feeds.

## Affected

- `vikunja >= 2.4.0 < 2.7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.