{"id":"CVE-2026-123530","kind":"vulnerability","aliases":["CVE-2026-123530"],"related":[],"title":"Vikunja: stolen session can enroll TOTP and lock owner out","description":"Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to enroll and enable TOTP without the account password. Attackers can call the TOTP enroll and enable endpoints with their own secret to lock the owner out, persisting even after password reset.","summary":"Vikunja before 2.7.1 lets anyone holding a stolen login session enroll and enable TOTP two-factor authentication without the account password. The attacker can lock the real owner out, and the lockout persists even after a password reset.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","vikunja"],"not_affected_if":["version-2.7.1-or-later"],"how_to_check":"- Check the Vikunja version with `vikunja version` or the image tag and compare it to `2.7.1`\n- Review accounts for TOTP enrolled without the owner's knowledge","fix":"- Vikunja: move to `2.7.1` or later","status":"open","published_at":"2026-11-08T02:16:43+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","triaged_at":"2026-11-08T02:25:09+00:00","updated_at":"2026-11-08T02:25:09+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:25:09Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: move to `2.7.1` or later","reach":"network","title":"Vikunja: stolen session can enroll TOTP and lock owner out","impact":"medium","summary":"Vikunja before 2.7.1 lets anyone holding a stolen login session enroll and enable TOTP two-factor authentication without the account password. The attacker can lock the real owner out, and the lockout persists even after a password reset.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker locks account owner out with their own TOTP secret","analyst_note":"","how_to_check":"- Check the Vikunja version with `vikunja version` or the image tag and compare it to `2.7.1`\n- Review accounts for TOTP enrolled without the owner's knowledge","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.7.1-or-later"],"who_is_affected":"Anyone running a self-hosted Vikunja instance older than 2.7.1 is exposed, because the flaw is in the TOTP enroll and enable endpoints. The attacker first needs a stolen session token, so instances where sessions are tightly protected carry less risk. Instances already on 2.7.1 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000679,"input_tokens":4265,"output_tokens":505,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123530':12A,15A '-2026':11A,14A '2.7.1':23B,62C 'account':41B,82C 'allow':69C 'anyon':25B 'attack':44B,70C,84C 'authent':38B,66C 'call':86C 'contain':63C 'cve':10A,13A 'enabl':33B,78C,91C 'endpoint':92C 'enrol':5A,31B,76C,89C 'even':55B,103C 'factor':37B 'hold':26B,71C 'host':19B 'let':24B 'lock':8A,46B,98C 'lockout':53B 'login':29B 'miss':65C 'owner':9A,49B,100C 'packag':16B 'password':42B,58B,83C,105C 'persist':54B,102C 'real':48B 'reset':59B,106C 'secret':96C 'self':18B 'self-host':17B 'session':3A,30B,74C 'stolen':2A,28B,73C 'totp':6A,34B,79C,88C 'two':36B 'two-factor':35B 'vikunja':1A,20B,21B,60C 'vulner':67C 'without':39B,80C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a self-hosted Vikunja instance older than 2.7.1 is exposed, because the flaw is in the TOTP enroll and enable endpoints. The attacker first needs a stolen session token, so instances where sessions are tightly protected carry less risk. Instances already on 2.7.1 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","vikunja"],"campaign_type":null,"search_a":"'-123530':12A,15A '-2026':11A,14A 'cve':10A,13A 'enrol':5A 'lock':8A 'owner':9A 'session':3A 'stolen':2A 'totp':6A 'vikunja':1A","search_b":"'2.7.1':23B 'account':41B 'anyon':25B 'attack':44B 'authent':38B 'enabl':33B 'enrol':31B 'even':55B 'factor':37B 'hold':26B 'host':19B 'let':24B 'lock':46B 'lockout':53B 'login':29B 'owner':49B 'packag':16B 'password':42B,58B 'persist':54B 'real':48B 'reset':59B 'self':18B 'self-host':17B 'session':30B 'stolen':28B 'totp':34B 'two':36B 'two-factor':35B 'vikunja':20B,21B 'without':39B","search_c":"'2.7.1':62C 'account':82C 'allow':69C 'attack':70C,84C 'authent':66C 'call':86C 'contain':63C 'enabl':78C,91C 'endpoint':92C 'enrol':76C,89C 'even':103C 'hold':71C 'lock':98C 'miss':65C 'owner':100C 'password':83C,105C 'persist':102C 'reset':106C 'secret':96C 'session':74C 'stolen':73C 'totp':79C,88C 'vikunja':60C 'vulner':67C 'without':80C","first_public_at":"2026-10-22T10:09:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123530","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123530","severity":null,"published_at":"2026-11-08T02:16:43+00:00","modified_at":"2026-11-08T02:16:43+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","fetched_at":"2026-11-08T02:21:09+00:00","note":null}],"documents":[{"id":99209,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-h4q3-mc9r-q7vv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:09:26+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99210,"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-missing-step-up-authentication-via-totp-enrollment-endpoints","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}