Skip to content
OpenAdvisories
High · 7.1 CVE-2026-33668 EUVD-2026-14913GHSA-94xm-jj8x-3cr4GO-2026-4849

Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect

Published Mar 24, 2026 · Updated Mar 26, 2026 · Assigned by GitHub_M

Vendor: go-vikunja Product: vikunja Package: code.vikunja.io/api Ecosystem: Go

Description

Vikunja is an open-source self-hosted task management platform. Starting in version 0.18.0 and prior to version 2.2.1, when a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. Three other authentication paths — API tokens, CalDAV basic auth, and OpenID Connect — do not verify user status, allowing disabled or locked users to continue accessing the API and syncing data. Version 2.2.1 patches the issue.

Affected products

VendorProductAffectedFixed
go-vikunja vikunja >= 0.18.0, < 2.2.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20260326T203309-150000.1.155.2 SUSE-SU-2026:1135-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go code.vikunja.io/api >= 0.18.0, < 2.2.1 2.2.1 GHSA-94xm-jj8x-3cr4
Go code.vikunja.io/api >= 0.18.0 — GO-2026-4849

Advisories 2

References