CVE-2026-123493

Vikunja versions 2.4.0 before 2.7.1 are vulnerable to an authentication bypass via Bot API tokens. The root cause is that token validation only verifies the bot's own status, allowing disabled or locked users to retain access if they hold pre-minted bot tokens. Attackers can exploit this to read ...