CVE-2026-123530: Vikunja missing authentication in TOTP enrollment

CVE-2026-123530 · Severity: medium · CVSS 5.9 · Published 2026-11-08

Vikunja is a task and project management application. An attacker with a stolen user session can enable two-factor authentication (TOTP) without knowing the account password, locking the legitimate owner out even after they reset their password. The attacker cannot access the account themselves, but can prevent the owner from regaining access and requires a database edit by an administrator to undo.

Technologies: Vikunja. Vendors: Vikunja.

Quick answers

Is CVE-2026-123530 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-123530 being exploited in the wild.
How severe is CVE-2026-123530?
Medium severity, with a CVSS score of 5.9, published 8 November 2026.
Which products and versions are affected?
Vikunja before 2.7.1.
Is there a fix for CVE-2026-123530?
Yes: fixed in 2.7.1. Until then: Require the current password on TOTP enroll and enable endpoints, and run the password check through a per-user failed-attempt rate limiter to prevent brute-force attacks. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123530 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-123530?
Check whether you run Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 2.7.1

Require the current password on TOTP enroll and enable endpoints, and run the password check through a per-user failed-attempt rate limiter to prevent brute-force attacks.

Technical details

The TOTP enroll and enable endpoints (UserTOTPEnroll and UserTOTPEnable in both v1 and v2 API routes) lack step-up authentication and only require a valid session token. An attacker with a stolen session can enroll a TOTP secret they control, enable it with a code from that secret, and trigger session deletion that logs out both the real owner and the attacker. This is a denial-of-service/lockout attack, not account takeover, but password resets do not clear the attacker's TOTP enrollment, and there is no self-service or administrative CLI method to remove it.

Affected products

  • Vikunja Vikunja before 2.7.1

Timeline

  • 2026-10-22: disclosed
  • 2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.