Medium severity5.4NVD Advisory· Published Nov 8, 2026· Updated Nov 8, 2026

CVE-2026-123493

Description

Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading and modifying shared projects via the HTTP API, CalDAV, MCP and feeds.

Affected products

Go Vikunja/Vikunjallm-fuzzy
Range: 2.4.0 - 2.7.1

Patches

Vulnerability mechanics

References

github.com/go-vikunja/vikunja/security/advisories/GHSA-5fc2-w2j4-6r8wnvd
www.vulncheck.com/advisories/vikunja-from-2.4.0-before-2.7.1-authentication-bypass-via-bot-api-tokensnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000