GHSA-5fc2-w2j4-6r8w: Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens

Published Nov 8, 2026

Updated

Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading and modifying shared projects via the HTTP API, CalDAV, MCP and feeds.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Vikunja to a version that resolves this vulnerability.
Fixed in 2.7.1

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs a pre-minted API token belonging to a bot user whose owning user has been disabled or locked. The issue allows that token holder to retain access to projects shared with the bot owner.

Which access paths remain available with an affected token?

Affected bot API tokens can be used through the HTTP API, CalDAV, MCP, and feeds. They can continue to read and modify shared projects.

Are all Vikunja versions affected?

The affected versions begin with 2.4.0 and extend to versions before 2.7.1. Version 2.7.1 is not included in the affected range.

What can be done before updating?

Revoke pre-existing API tokens owned by bot users associated with disabled or locked users. This removes the token-based access path described by the vulnerability.

GHSA-5fc2-w2j4-6r8w: Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which access paths remain available with an affected token?

Are all Vikunja versions affected?

What can be done before updating?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which access paths remain available with an affected token?

Are all Vikunja versions affected?

What can be done before updating?