CVE-2026-33316
Vikunja is an open-source self-hosted task management platform.
Published Mar 24, 2026 · updated Jun 17, 2026 · vikunja vikunja
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regain access to their accounts. The function sets the user’s status to after a successful password reset without verifying whether the account was previously disabled. By requesting a reset token through and completing the reset via , a disabled user can reactivate their account and bypass administrator-imposed account disablement. Version 2.2.0 patches the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 24, 2026 · NIST NVD
Detected
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regain access to their accounts. The function sets the user’s status to after a successful password reset without verifying whether the account was previously disabled. By requesting a reset token through and completing the reset via , a disabled
Jun 17, 2026 · NIST NVD
Updated
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regain access to their accounts. The function sets the user’s status to after a successful password reset without verifying whether the account was previously disabled. By requesting a reset token through and completing the reset via , a disabled
Affected
- cpe vikunja/vikunjaversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33316
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33316
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regain access to their accounts. The function sets the user’s status to after a successful pa
nvd.nist.gov