CVE-2026-33316 — Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regain access to their …
Published: 2026-03-24 · CVSS: 8.1 · CVSS 3.1
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regain access to their accounts. The `ResetPassword()` function sets the user’s status to `StatusActive` after a successful password reset without verifying whether the account was previously disabled. By requesting a reset token through `/api/v1/user/password/token` and completing the reset via `/api/v1/user/password/reset`, a disabled user can reactivate their account and bypass administrator-imposed account disablement. Version 2.2.0 patches the issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7