Vikunja Task Management Platform Vulnerability Allows Unauthorized Account Restoration

CVE-2026-33316

What is CVE-2026-33316?

The Vikunja Task Management Platform contains a security flaw in the password reset mechanism affecting versions prior to 2.2.0. The vulnerability allows users whose accounts have been disabled to bypass restrictions and regain access. This occurs because the ResetPassword() function inadvertently activates a disabled account upon successful reset, without verifying its prior state. By exploiting the password reset token endpoint, these users can reactivate their accounts and bypass the administrative block. The issue has been addressed in version 2.2.0, ensuring that only eligible users can reset their passwords and regain access.

References