CVE-2026-62376High· 8.1▾ TwilightVikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in plaintext. If an attacker gains read access to th…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the user_tokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over user accounts without knowing passwords. Version 2.4.0 fixes the issue.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
code.vikunja.io/api <= 2.3.0Patched in:
code.vikunja.io/api 2.4.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-57458High· 8.1Vikunja is an open-source self-hosted task management platform
CVE-2026-62367HighVikunja is an open-source self-hosted task management platform
CVE-2026-54766MediumVikunja is an open-source self-hosted task management platform
CVE-2026-55064Medium· 4.3Vikunja is an open-source self-hosted task management platform
CVE-2026-55065High· 8.1Vikunja is an open-source self-hosted task management platform
CVE-2026-55066High· 7.1Vikunja is an open-source self-hosted task management platform