CVE-2026-123493

Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading an...

EUVD-2026-119378

Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading an...

Principal-Type Confusion

code.vikunja.io/api is vulnerable to a principal-type confusion. The vulnerability is due to missing type validation in permission checks, which allows an attacker with a link-sharing JWT to exploit ID collisions to remove victims from teams, enumerate and delete their bot users, or access team...