Vikunja CVE-2026-33668

Vikunja 0.18.0 to 2.2.0. Attacker must have valid API token, CalDAV credentials, or OpenID Connect identity from a disabled/locked user account. Local login and JWT refresh paths are patched; only API token, CalDAV basic auth, and OpenID Connect authentication paths bypass disabled account checks.

This vulnerability presents moderate-to-high real-world risk despite missing CVSS and EPSS scores. The attack vector is network-accessible (requires valid credentials), the attack complexity is low (attacker simply uses existing credentials after account disabling), and no privileges are required beyond standard user account access. The technical impact is substantial: disabled accounts can continue reading and potentially writing task data, syncing calendar events, and maintaining organizational data access indefinitely. In administrative contexts where account disabling is the primary access revocation control (employee termination, privilege revocation, security incident containment), this represents a critical control gap. The vulnerability is not noted as actively exploited in KEV status, but the fix availability across multiple commits indicates this was a real-world discovery. Given that the issue affects all versions from 0.18.0 forward and requires a version upgrade to 2.2.1 or later, and considering that self-hosted systems may have extended deployment cycles, this represents a meaningful priority for organizations running affected versions in security-sensitive contexts.

An employee is terminated and their Vikunja account is administratively disabled to prevent further access. However, the attacker (the former employee or an insider with access to their cached credentials) can continue syncing task data and calendar information using their saved API token or cached OIDC session without triggering authentication failures. Depending on Vikunja's data model, this may allow the attacker to read sensitive project information, task details, or calendar events long after they should have lost access, or in worst case manipulate shared data if write permissions are still enforced. The attack requires low complexity since it leverages existing credentials and requires no additional exploitation steps beyond using standard client tools or API calls with the cached authentication credentials.