CVE-2026-123493

MediumCVSS 5.4/10Last modified Nov 10, 2026

Description

Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading and modifying shared projects via the HTTP API, CalDAV, MCP and feeds.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published
Nov 8, 2026
Last modified
Nov 10, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1234943.5Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account CVE-2026-1234954.6Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enablCVE-2026-1234963.3Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the reposCVE-2026-1234976.8Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTPCVE-2026-1234983.7Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions byCVE-2026-1234995.9Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by spCVE-2026-12356.5The WP eCommerce WordPress plugin through 3.15.1 unserializes user input via ajax actions, which could allow unauthenticated users to perforCVE-2026-123506.5IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that cCVE-2026-1235006.2Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives created with umask peCVE-2026-1235016.5Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory thCVE-2026-1235025.2Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request CVE-2026-1235035.4Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project write access to delete b
CVE-2026-123493: Medium severity, CVSS 5.4 | Vulnix