Missing Authentication Vulnerability in Vikunja by Vikunja
CVE-2026-123530

6MEDIUM

Key Information:

Vendor

Go-vikunja

Status
Vikunja
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123530?

The Vikunja application prior to version 2.7.1 has a critical flaw that exposes it to a missing authentication vulnerability. This issue permits intruders who have obtained a session to enroll and activate Time-Based One-Time Password (TOTP) functions without needing the user's password. Exploiting this vulnerability allows an attacker to manipulate the TOTP settings using their own secrets, effectively locking the legitimate account owner out, which may persist even after the owner performs a password reset.

Affected Version(s)

vikunja 0 < 2.7.1

vikunja 2.7.1

References

https://github.com/go-vikunja/vikunja/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/vikunja-before-2.7.1...
third-party-advisory

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dagadjno
.