---
id: "CVE-2026-123530"
page: "https://infrastack.ai/live/CVE-2026-123530"
kind: "vulnerability"
aliases: ["CVE-2026-123530"]
title: "Vikunja: stolen session can enroll TOTP and lock owner out"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "vikunja"]
not_affected_if: ["version-2.7.1-or-later"]
published_at: "2026-11-08T02:16:43+00:00"
first_seen_at: "2026-11-08T02:21:09+00:00"
updated_at: "2026-11-08T02:25:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123530", "first_seen_at": "2026-11-08T02:21:09+00:00"}]
exploit_sources: []
---

# Vikunja: stolen session can enroll TOTP and lock owner out

Link for people: https://infrastack.ai/live/CVE-2026-123530 (this .md is for agents)

Vikunja before 2.7.1 lets anyone holding a stolen login session enroll and enable TOTP two-factor authentication without the account password. The attacker can lock the real owner out, and the lockout persists even after a password reset.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Vikunja version with `vikunja version` or the image tag and compare it to `2.7.1`
- Review accounts for TOTP enrolled without the owner's knowledge

## Fix

- Vikunja: move to `2.7.1` or later

## Timeline

- 2026-11-08T02:21:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123530

## Documents

- [advisory] Vendor advisory: github.com https://github.com/go-vikunja/vikunja/security/advisories/GHSA-h4q3-mc9r-q7vv
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vikunja-before-2.7.1-missing-step-up-authentication-via-totp-enrollment-endpoints

## From the sources

Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to enroll and enable TOTP without the account password. Attackers can call the TOTP enroll and enable endpoints with their own secret to lock the owner out, persisting even after password reset.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_