{"id":"CVE-2026-123493","kind":"vulnerability","aliases":["CVE-2026-123493"],"related":[],"title":"Vikunja: disabled users keep access through their bot users' API tokens","description":"Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading and modifying shared projects via the HTTP API, CalDAV, MCP and feeds.","summary":"Vikunja, a self-hosted task manager, checks only the bot account's own status when validating API tokens. A disabled or locked user who already holds a token minted for a bot user can keep reading and changing shared projects over the API, CalDAV, MCP and feeds.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-tokens","package","self-hosted","vikunja"],"not_affected_if":["no-bot-users","version-2.7.1-or-later"],"how_to_check":"- Check the Vikunja version with the server's version endpoint or the image tag; affected range is `2.4.0` up to but not including `2.7.1`.\n- List bot users and their API tokens in the admin area and look for tokens still in use by accounts that were disabled or locked.","fix":"- Vikunja: upgrade to `2.7.1` or later (per the NVD affected range).","status":"open","published_at":"2026-11-08T02:16:36+00:00","first_seen_at":"2026-11-08T02:21:07+00:00","triaged_at":"2026-11-08T02:25:16+00:00","updated_at":"2026-11-08T02:25:16+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:25:16Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: upgrade to `2.7.1` or later (per the NVD affected range).","reach":"network","title":"Vikunja: disabled users keep access through their bot users' API tokens","impact":"medium","summary":"Vikunja, a self-hosted task manager, checks only the bot account's own status when validating API tokens. A disabled or locked user who already holds a token minted for a bot user can keep reading and changing shared projects over the API, CalDAV, MCP and feeds.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","api-tokens"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Former users keep reading and editing shared projects through tokens.","analyst_note":"","how_to_check":"- Check the Vikunja version with the server's version endpoint or the image tag; affected range is `2.4.0` up to but not including `2.7.1`.\n- List bot users and their API tokens in the admin area and look for tokens still in use by accounts that were disabled or locked.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.7.1-or-later","no-bot-users"],"who_is_affected":"Teams that run self-hosted Vikunja from 2.4.0 before 2.7.1 and use bot users with API tokens. Exposure depends on whether tokens were issued to bot accounts that are shared with others and whether disabled users had such tokens before being locked out. Instances on other versions or without bot users are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000715,"input_tokens":4300,"output_tokens":569,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123493':14A,17A '-2026':13A,16A '2.4.0':76C '2.7.1':78C 'access':5A,92C 'account':37B 'allow':85C 'alreadi':51B 'api':10A,19B,43B,69B,94C,128C 'api-token':18B 'attack':111C 'authent':81C 'bot':8A,36B,58B,99C,107C,116C 'bypass':82C 'caldav':70B,129C 'chang':64B 'check':33B,105C 'contain':79C 'cve':12A,15A 'disabl':2A,46B,86C 'feed':73B,132C 'hold':52B,112C 'host':24B,30B 'http':127C 'keep':4A,61B,119C 'lock':48B,88C 'manag':32B 'mcp':71B,130C 'mint':55B,115C 'modifi':122C 'own':96C 'packag':21B 'pre':114C 'pre-mint':113C 'project':66B,124C 'read':62B,120C 'retain':91C 'self':23B,29B 'self-host':22B,28B 'share':65B,123C 'status':40B,110C 'task':31B 'token':11A,20B,44B,54B,95C,102C,117C 'user':3A,9A,49B,59B,89C,100C 'valid':42B,103C 'via':125C 'vikunja':1A,25B,26B,74C 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"Teams that run self-hosted Vikunja from 2.4.0 before 2.7.1 and use bot users with API tokens. Exposure depends on whether tokens were issued to bot accounts that are shared with others and whether disabled users had such tokens before being locked out. Instances on other versions or without bot users are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apitokens","medium","package","selfhosted","vikunja"],"campaign_type":null,"search_a":"'-123493':14A,17A '-2026':13A,16A 'access':5A 'api':10A 'bot':8A 'cve':12A,15A 'disabl':2A 'keep':4A 'token':11A 'user':3A,9A 'vikunja':1A","search_b":"'account':37B 'alreadi':51B 'api':19B,43B,69B 'api-token':18B 'bot':36B,58B 'caldav':70B 'chang':64B 'check':33B 'disabl':46B 'feed':73B 'hold':52B 'host':24B,30B 'keep':61B 'lock':48B 'manag':32B 'mcp':71B 'mint':55B 'packag':21B 'project':66B 'read':62B 'self':23B,29B 'self-host':22B,28B 'share':65B 'status':40B 'task':31B 'token':20B,44B,54B 'user':49B,59B 'valid':42B 'vikunja':25B,26B","search_c":"'2.4.0':76C '2.7.1':78C 'access':92C 'allow':85C 'api':94C,128C 'attack':111C 'authent':81C 'bot':99C,107C,116C 'bypass':82C 'caldav':129C 'check':105C 'contain':79C 'disabl':86C 'feed':132C 'hold':112C 'http':127C 'keep':119C 'lock':88C 'mcp':130C 'mint':115C 'modifi':122C 'own':96C 'pre':114C 'pre-mint':113C 'project':124C 'read':120C 'retain':91C 'share':123C 'status':110C 'token':95C,102C,117C 'user':89C,100C 'valid':103C 'via':125C 'vikunja':74C 'vulner':83C","first_public_at":"2026-10-22T09:59:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123493","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123493","severity":null,"published_at":"2026-11-08T02:16:36+00:00","modified_at":"2026-11-08T02:16:36+00:00","first_seen_at":"2026-11-08T02:21:07+00:00","fetched_at":"2026-11-08T02:21:07+00:00","note":null}],"documents":[{"id":99135,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-5fc2-w2j4-6r8w","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T09:59:41+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99136,"url":"https://www.vulncheck.com/advisories/vikunja-from-2.4.0-before-2.7.1-authentication-bypass-via-bot-api-tokens","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}