CVE-2026-33668 HIGH

CVE-2026-33668: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect

Vendor Go-Vikunja
Product vikunja
Weakness CWE-285
Published March 24, 2026
Last update March 26, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Vikunja is an open-source self-hosted task management platform. Starting in version 0.18.0 and prior to version 2.2.1, when a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. Three other authentication paths — API tokens, CalDAV basic auth, and OpenID Connect — do not verify user status, allowing disabled or locked users to continue accessing the API and syncing data. Version 2.2.1 patches the issue.

Key dates

02Disclosure timeline

March 24, 2026 CVE published
March 26, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-1078 AppHouseKitchen AlDente Charge Limiter XPC Service com.apphousekitchen.aldente-pro.helper shouldAcceptNewConnection improper authorization CVE-2021-1574 Cisco Business Process Automation Privilege Escalation Vulnerabilities CVE-2025-8791 LitmusChaos Litmus list_projects improper authorization CVE-2026-7091 code-projects Invoice System in Laravel User Management user improper authorization CVE-2024-7578 Alien Technology ALR-F800 cmd.php improper authorization