CVE-2026-123493 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja, a self-hosted task manager, checks only the bot account's own status when validating API tokens. A disabled or locked user who already holds a token minted for a bot user can keep reading and changing shared projects over the API, CalDAV, MCP and feeds.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run self-hosted Vikunja from 2.4.0 before 2.7.1 and use bot users with API tokens. Exposure depends on whether tokens were issued to bot accounts that are shared with others and whether disabled users had such tokens before being locked out. Instances on other versions or without bot users are not described as affected.
Not affected if no-bot-users, version-2.7.1-or-later
Who cares api-tokens, self-hosted, vikunja
2.4.0 up to but not including 2.7.1.2.7.1 or later (per the NVD affected range).Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading and modifying shared projects via the HTTP API, CalDAV, MCP and feeds.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.