Executive brief
Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api
Affected products
- Go code.vikunja.io/api
Junglewise Threat Intelligence
CVE-2026-33668: GO-2026-4849 - Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api
CVE-2026-33668 · Severity: medium · CVSS 4 · Published 2026-03-26
Technologies: code.vikunja.io/api (Go). Vendors: Go.
Related threats
- Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket
- Vikunja task authorization bypass in bucket endpoint
- Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permit
- Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shar
- Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/pro