What is the CVSS score of CVE-2026-27575?

CVE-2026-27575 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Vikunja are affected by CVE-2026-27575?

Vikunja versions up to 2.0.0 contain a critical vulnerability (CVSS 9.1) that enables attackers to set weak passwords, potentially compromising user account security and organizational data.

Is there a public PoC exploit available for CVE-2026-27575?

Yes, a public proof-of-concept exploit is available for CVE-2026-27575. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27575?

Within 24 hours: Inventory all Vikunja deployments and document affected versions; disable or restrict Vikunja access if operationally feasible, or implement compensating controls listed below. Within 7 days: Implement network segmentation to limit Vikunja exposure; enforce multi-factor authentication (MFA) for all Vikunja user accounts; monitor authentication logs for suspicious activity. Within 30 days: Contact Vikunja vendor for patch availability and timeline; evaluate alternative task management solutions; conduct security assessment of all user accounts for unauthorized access or weak credentials.

Vikunja CVE-2026-27575

CRITICAL

Weak Password Requirements (CWE-521)

2026-02-25 security-advisories@github.com

GHSA-3ccg-x393-96v8

Information Disclosure Vikunja Suse

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SUSE

CRITICAL

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 05, 2026 - 17:21 vuln.today

Public exploit code

CVE Published

Feb 25, 2026 - 22:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain valid after a user changes their password. An attacker who compromises an account (via brute-force or credential stuffing) can maintain persistent access even after the victim resets their password. Version 2.0.0 contains a fix.