CVE-2026-33668: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect
When a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. Three other authentication paths — API tokens, CalDAV basic auth, and OpenID Connect — do not verify user status, allowing disabled or locked users to continue accessing the API and syncing data.
References
- github.com/advisories/GHSA-94xm-jj8x-3cr4
- github.com/go-vikunja/vikunja
- github.com/go-vikunja/vikunja/commit/033922309f492996c928122fb49b691339199c35
- github.com/go-vikunja/vikunja/commit/04704e0fde4b027039cf583110cee7afe136fc1b
- github.com/go-vikunja/vikunja/commit/0b04768d830c80e9fde1b0962db1499cc652da0e
- github.com/go-vikunja/vikunja/commit/fd452b9cb6457fd4f9936527a14c359818f1cca7
- github.com/go-vikunja/vikunja/security/advisories/GHSA-94xm-jj8x-3cr4
- nvd.nist.gov/vuln/detail/CVE-2026-33668
- vikunja.io/changelog/vikunja-v2.2.2-was-released
Code Behaviors & Features
Detect and mitigate CVE-2026-33668 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →