Vikunja
CVE-2026-28268
CRITICAL
GHSA-rfjg-6m84-crj2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIntercept password reset token
-
DeliveryAccess token via logs/history/phishing
-
ExploitUse token to reset target account password
-
ExecutionAuthenticate as victim with new credentials
-
ImpactAchieve persistent account takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Incomplete cleanup
|
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against Vikunja versions prior to 2.1.0 with default password reset mechanism enabled. Attacker requires interception of single password reset token through logs, browser history, or phishing. |
| Impact | CVSS 9.8. Self-hosted task management platform — incomplete cleanup could expose sensitive project data. |
| Exploit ScenarioDerived | Removed user retains access to shared tasks/projects through residual state that wasn't properly cleaned up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Business logic vulnerability in Vikunja task management platform before 2.1.0 allows incomplete resource cleanup, potentially enabling unauthorized access to shared resources after user removal.
Earlier versions of this analysis (1)
Incomplete state cleanup vulnerability in Vikunja.
RemediationAI
Update to Vikunja 2.1.0. Audit shared resource memberships.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-459 incomplete cleanup. When users are removed from shared resources, associated state is not fully purged, potentially leaving residual access.
Know when Vikunja gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever. This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls. Version 2.1.0 contains a patch for the issue.
Executive ViewAI
Vikunja task management deployments running versions prior to 2.1.0 face a critical authentication bypass risk where password reset tokens can be reused indefinitely, allowing attackers to take over any user account without detection. This vulnerability directly threatens unauthorized access to sensitive task data, project information, and organizational workflows across all affected instances.
Apply vendor patch. If immediate patching is not possible: disable public password reset functionality, restrict password reset endpoints to internal networks only, implement rate limiting on password reset requests, monitor all password reset activity in application logs, and mandate immediate password change upon next login.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)GitHub Advisory
Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any
Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC avai
Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully cont
Stored cross-site scripting (XSS) in Vikunja prior to version 2.0.0 allows authenticated attackers to steal authenticati
Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to va
Vikunja is an open-source self-hosted task management platform. [CVSS 6.1 MEDIUM]
Instance-wide data breach in Vikunja before 2.2.1 lets remote attackers exfiltrate and destroy every file attachment acr
Vikunja's OIDC callback handler issues a full JWT to any successfully matched user without checking whether that account
Vikunja instances before 2.6.0 expose CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) that are not covered b
Vikunja versions before 2.6.0 ship authentication endpoints under /api/v2 (login, register, password-reset, and OAuth to
Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint,
Privilege escalation in Vikunja 2.3.0 allows a user who holds a narrowly scoped API token (permissions {"oauth":["author
Exploit-DB