CVE-2026-33668 Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect
Disabled or locked users can bypass authentication restrictions via API tokens, CalDAV, and OpenID Connect to access data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33668?
CVE-2026-33668 is a high-severity authentication bypass vulnerability in go-vikunja vikunja, published on 24 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Vikunja is an open-source self-hosted task management platform. Starting in version 0.18.0 and prior to version 2.2.1, when a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. Three other authentication paths — API tokens, CalDAV basic auth, and OpenID Connect — do not verify user status, allowing disabled or locked users to continue accessing the API and syncing data. Version 2.2.1 patches the issue.
Which versions are affected by CVE-2026-33668?
3 open source packages ship an affected version, including code.vikunja.io/api. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
code.vikunja.io/api Go | From 0.18.0 | None |
code.vikunja.io/api Go | From 0.18.0 | 2.2.1 |
code.vikunja.io/api Go | From 0.18.0 | 2.2.1 |
Products include Vikunja Vikunja.
How do I fix CVE-2026-33668?
Upgrade code.vikunja.io/api to 2.2.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-33668 being exploited?
There is no known exploitation of CVE-2026-33668 in the wild and no public exploit code.
Other vulnerabilities in go-vikunja vikunja
- CVE-2026-28268 Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse
- CVE-2026-27575 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change
- CVE-2026-25935 Vikunja Affected by XSS Via Task Preview
- CVE-2026-35595 Vikunja Affected by Privilege Escalation via Project Reparenting
- CVE-2026-33316 Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement
Sources
Also known as GHSA-94xm-jj8x-3cr4, GO-2026-4849.