What is the CVSS score of CVE-2026-27575?

CVE-2026-27575 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-27575?

Yes, a public proof-of-concept exploit is available for CVE-2026-27575. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27575?

Within 24 hours: Inventory all Vikunja deployments and document affected versions; disable or restrict Vikunja access if operationally feasible, or implement compensating controls listed below. Within 7 days: Implement network segmentation to limit Vikunja exposure; enforce multi-factor authentication (MFA) for all Vikunja user accounts; monitor authentication logs for suspicious activity. Within 30 days: Contact Vikunja vendor for patch availability and timeline; evaluate alternative task management solutions; conduct security assessment of all user accounts for unauthorized access or weak credentials.

Vikunja CVE-2026-27575

CRITICAL

Weak Password Requirements (CWE-521)

2026-02-25 security-advisories@github.com

GHSA-3ccg-x393-96v8

Information Disclosure Vikunja Suse

9.1

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Brute-force weak passwords against Vikunja login
Exploit

Gain account access
Execution

Maintain session persistence after password change
Impact

Access user data with valid session token

Vulnerability Assessment

Weakness	CWE CWE-521 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Password strength requirements
Exploitation Conditions	Vikunja versions prior to 2.0.0 with default password policy enforcement disabled. Attacker requires network access to login endpoint. No authentication required initially; exploit relies on weak password enforcement and session invalidation bypass.
Impact	CVSS 9.1. Weak passwords enable brute-force attacks and credential stuffing.
Exploit ScenarioDerived	Attacker performs credential stuffing or brute force against Vikunja accounts using common passwords that pass the weak validation.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:55 CVSS 9.1

Missing password strength requirements in Vikunja.

RemediationAI

Update to Vikunja 2.0.0. Implement minimum password length and complexity requirements.

Affected Packages

go code.vikunja.io/api no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in go

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-521 weak password requirements. The application accepts short or trivial passwords without complexity requirements.

Know when Vikunja gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SUSE CRITICAL

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

PoC Detected

Mar 05, 2026 - 17:21 vuln.today

Public exploit code

CVE Published

Feb 25, 2026 - 22:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain valid after a user changes their password. An attacker who compromises an account (via brute-force or credential stuffing) can maintain persistent access even after the victim resets their password. Version 2.0.0 contains a fix.

Executive ViewAI

Why It Matters

Vikunja versions up to 2.0.0 contain a critical vulnerability (CVSS 9.1) that enables attackers to set weak passwords, potentially compromising user account security and organizational data. With public exploits available and no patch currently available, immediate action is required to protect systems and user credentials from unauthorized access.

Business Impact: Severe

Compensating Controls

Implement MFA on all Vikunja accounts; enforce strong password policies at directory service level (Active Directory/LDAP); deploy WAF rules to monitor and block password-setting requests with low entropy patterns; restrict Vikunja network access via firewall/VPN; disable self-service password reset functionality if available; implement real-time alerting on authentication failures; consider disabling Vikunja until patch is available if not critical to operations.

Threat Intelligence Overview

EPSS Score

0.0%

Top 98% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.