{"id":"CVE-2026-62376","kind":"vulnerability","aliases":["CVE-2026-62376","GHSA-r6w9-259g-gwrv","GO-2026-6748"],"related":[],"title":"Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api","description":"Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: code.vikunja.io/api before v2.4.0.","summary":"Vikunja's Go API stores password-reset and email-confirmation tokens in plaintext in the database. Anyone who can read the database can take over any account that has a pending reset or confirmation token.","severity":"high","cvss":8.1,"epss":0.00215,"exploited":false,"exploited_at":null,"products":[{"name":"code.vikunja.io/api","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","vikunja"],"not_affected_if":["managed-hosting","no-database-read-exposure"],"how_to_check":"Check whether your Vikunja API build is older than v2.4.0 (go list -m code.vikunja.io/api, or the release tag you deployed).","fix":"Upgrade code.vikunja.io/api to v2.4.0 or later, then rotate or expire any outstanding password-reset and email-confirmation tokens.","status":"open","published_at":"2026-10-09T21:17:05+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:52:46+00:00","updated_at":"2026-10-23T19:52:46+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:52:46Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade code.vikunja.io/api to v2.4.0 or later, then rotate or expire any outstanding password-reset and email-confirmation tokens.\nunknown","summary":"Vikunja's Go API stores password-reset and email-confirmation tokens in plaintext in the database. Anyone who can read the database can take over any account that has a pending reset or confirmation token.","category":"package","who_cares":["vikunja","go","self-hosted"],"confidence":0.8,"analyst_note":"Confirm the fixed version and whether existing plaintext tokens are invalidated by the upgrade, using GHSA-r6w9-259g-gwrv or GO-2026-6748.","how_to_check":"Check whether your Vikunja API build is older than v2.4.0 (go list -m code.vikunja.io/api, or the release tag you deployed).\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting","no-database-read-exposure"],"severity_if_unknown":"high"},"cost_usd":0.000394,"input_tokens":2204,"output_tokens":348,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':24A,32A,35A '-62376':25A,36A '-6748':33A '/api':22A,39A,153C '/api.':104C '/email-confirm':8A,90C '259g':29A 'access':18A,100C 'account':13A,74B,95C 'addit':113C,145C 'advisori':108C 'affect':146C 'anyon':64B 'api':49B 'automat':119C 'caus':129C 'code.vikunja.io':21A,38A,103C,152C 'code.vikunja.io/api':20A,37A,151C 'code.vikunja.io/api.':102C 'confirm':57B,81B 'contain':112C 'could':116C 'cve':23A,34A 'databas':11A,63B,69B,93C 'db':16A,98C 'edit':140C 'email':56B 'email-confirm':55B 'enabl':12A,94C 'fals':131C 'false-posit':130C 'ghsa':27A 'ghsa-r6w9-259g-gwrv':26A 'go':31A,40B,48B,123C 'gwrv':30A 'host':44B 'map':120C 'modul':124C,147C 'note':105C 'packag':41B 'password':6A,52B,88C 'password-reset':5A,51B,87C 'pend':78B 'plaintext':2A,60B,84C 'pleas':137C 'posit':132C 'r6w9':28A 'read':17A,67B,99C 'report':111C,133C,143C 'reset':7A,53B,79B,89C 'scanner':136C 'self':43B 'self-host':42B 'sourc':107C 'standard':122C 'storag':3A,85C 'store':50B 'suggest':138C 'take':71B 'takeov':14A,96C 'token':9A,58B,82B,91C 'v2.4.0':155C 'version':114C,125C,149C 'vikunja':1A,45B,46B,83C 'vulner':135C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-09T21:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6748","url":"https://pkg.go.dev/vuln/GO-2026-6748","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-62376","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62376","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-62376","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62376","severity":null,"published_at":"2026-10-09T21:17:05+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}