---
id: "CVE-2026-111917"
kind: "vulnerability"
aliases: ["CVE-2026-111917"]
title: "Vikunja: revoked sessions keep WebSocket access to notifications"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "vikunja", "websocket"]
not_affected_if: ["version-2.7.0-or-later"]
published_at: "2026-10-17T19:16:34+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:36:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111917", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Vikunja: revoked sessions keep WebSocket access to notifications

Vikunja 2.3.0 before 2.7.0 does not check the JWT session ID against active sessions on its WebSocket endpoint, so a revoked session keeps working. An attacker holding a stolen access token keeps receiving the victim's notification pushes, including comment, task and project content.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Vikunja version; `2.3.0` through `2.6.x` are affected.
- Confirm whether the instance exposes `/api/v2/ws` to users who could have had a session revoked.

## Fix

- Upgrade Vikunja to `2.7.0` or later.
- After upgrading, rotate access tokens for users whose sessions were deleted or who enrolled in TOTP before the fix.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111917

## From the sources

Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to /api/v2/ws after session deletion or TOTP enrollment, continuing to receive the victim's notification.created pushes, including comment, task and project content.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_