Vikunja CVE-2026-91973

Exploitation requires a Vikunja deployment below 2.6.0 whose CalDAV/feed endpoints (/dav, /.well-known, /feeds) are reachable by the attacker - typically an instance exposed to the internet or to an untrusted network segment - and at least one account that authenticates with a password guessable from a dictionary or credential list. The attack specifically abuses the absence of rate limiting on that BasicAuth code path, so any deployment where those routes are already throttled by an upstream proxy blunts it. Limits on success: accounts protected by OIDC/SSO or a second factor are not compromised by password guessing alone, the CVSS vector reports no integrity or availability impact (VC:H/VI:N/VA:N), and the attacker gains only the access level of whichever account is cracked. Authentication requirements per the provided vector are unauthenticated (PR:N, UI:N).

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) yields 8.7 and reflects unauthenticated, low-complexity, network-reachable exploitation with high confidentiality impact. That score should be read with care: the metric set implies automated, unattended guessing is feasible against any internet-reachable instance, but the practical outcome depends entirely on password strength - a strong-password or SSO/2FA deployment is far less exposed than one with weak or reused passwords. No CISA KEV listing and no public exploit code were provided, and no EPSS score was supplied, so active exploitation status is unconfirmed; the VulnCheck attribution indicates an independent researcher disclosure rather than observed attacks. The absence of VI and VA impact limits blast radius to unauthorized read access of the compromised user's data. Treat this as a genuine priority for internet-exposed instances with password-only auth, but as lower urgency for SSO-protected or internal-only deployments.

An attacker enumerates internet-facing Vikunja instances and posts high-volume BasicAuth requests to /dav or /.well-known using common username/password dictionaries. Because no rate limiting or lockout triggers, the attacker can keep guessing until a password-only account authenticates, then pulls that user's projects, tasks, and feeds over the CalDAV/feed API. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no privileges or user interaction are needed, making this trivially automatable, though success still hinges on password quality.