Patch Forecast
Amber warning
Patch this week.

CVE-2026-62376 · GHSA-r6w9-259g-gwrv

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

Risk score
61/100
CVSS
8.1 v3.1
Exploit chance (30 days)
0.2%
Published
9 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the user_tokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they…
Affected
code.vikunja.io/api (go) <= 2.3.0
Fix
Upgrade code.vikunja.io/api to 2.4.0 or later.
Exploitation
No known exploitation

Story map

Story map: code.vikunja.io/apiTHE FLAWSTHE FIXCVE-2026-62376Vikunja: Plaintext storage ofpassword-reset/email-confirmtokens in database enables…CVSS 8.1 · EPSS 0%CVE-2026-91972Vikunja: Every /api/v2pre-auth endpoint isunthrottled on a stock install…CVSS 8.7 · EPSS 1%CVE-2026-68581Vikunja: Link-share principalID collision allowscross-account API token…CVSS 8.1 · EPSS 0%CVE-2026-91985Vikunja: Read-only projectmembers can obtain any linkshare's access hash via the…EPSS 0%Upgrade code.vikunja.io/api2.4.0or later on your release lineWho is exposedcode.vikunja.io/api (go) <= 2.5.0AMBER · PATCH THIS WEEKcode.vikunja.io/apiregisterAPIRoutesV2 neverapplies the unconditionalpre-auth rate-limit floor(unauthRateLimit()) to the v2public routes — it passes thatlimiter only to /api/v2/ws — andotherwise relies on…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-312 (CWE-312)13 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

code.vikunja.io/api: Amber, patch this week. registerAPIRoutesV2 never applies the unconditional pre-auth rate-limit floor (unauthRateLimit()) to the v2 public routes — it passes that limiter only to /api/v2/ws — and otherwise relies on setupRateLimit, which registers nothing when ratelimit.enabled is false (the default). So on a stock install every v2 pre-auth …

The flaws

  • CVE-2026-62376: Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access (CVSS 8.1 · EPSS 0%)
  • CVE-2026-91972: Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited (CVSS 8.7 · EPSS 1%)
  • CVE-2026-68581: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management (CVSS 8.1 · EPSS 0%)
  • CVE-2026-91985: Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level (EPSS 0%)

The fix

Upgrade code.vikunja.io/api: 2.4.0 or later on your release line

Who is exposed: code.vikunja.io/api (go) <= 2.5.0

Where it stands

  • Public proof of concept

Connects to

Why it is Amber

  • CVSS 8.1 high
  • Remotely exploitable without logging in
  • On your watchlist: Go

Affected packages

PackageEcosystemVulnerableFixed in
code.vikunja.io/apigo<= 2.3.02.4.0

References

Original description

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over user accounts without knowing passwords. Version 2.4.0 fixes the issue.

Last activity 9 Oct 2026. Patch Forecast updates every hour.