Weak Password Enforcement in Vikunja Task Management Platform

CVE-2026-27575

What is CVE-2026-27575?

Vikunja, an open-source self-hosted task management tool, presents a security risk due to its lack of stringent password strength requirements, allowing users to set easily guessable passwords. Furthermore, when users change their passwords, active sessions continue to be valid, enabling attackers who have compromised an account to maintain access even after the victims have reset their passwords. This vulnerability underscores the critical importance of robust password policies and session management. Users are encouraged to update to version 2.0.0, which addresses these issues.

References