CVE-2026-33316: Vikunja Auth Bypass Vulnerability

CVE-2026-33316 Overview

CVE-2026-33316 is an authentication bypass vulnerability in Vikunja, an open-source self-hosted task management platform. A critical flaw in Vikunja's password reset logic allows disabled users to regain access to their accounts by exploiting the ResetPassword() function, which sets the user's status to StatusActive after a successful password reset without verifying whether the account was previously disabled by an administrator.

Critical Impact

Disabled users can bypass administrator-imposed account restrictions and reactivate their accounts through the password reset flow, potentially leading to unauthorized access to sensitive task management data and organizational workflows.

Affected Products

• Vikunja versions prior to 2.2.0
• Self-hosted Vikunja instances with user account management enabled
• Vikunja deployments using the built-in password reset functionality

Discovery Timeline

• 2026-03-24 - CVE-2026-33316 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33316

Vulnerability Analysis

This authentication bypass vulnerability (CWE-284: Improper Access Control) exists in Vikunja's password reset implementation. The core issue stems from the ResetPassword() function unconditionally setting a user's account status to StatusActive upon successful password reset completion. This implementation fails to preserve the previous account state, specifically ignoring whether an administrator had intentionally disabled the user account.

The attack flow involves two API endpoints: first, the attacker requests a password reset token via /api/v1/user/password/token, and then completes the reset process via /api/v1/user/password/reset. Upon completion, the function activates the account regardless of its prior disabled state, effectively circumventing administrative security controls.

Root Cause

The root cause is a missing state validation check in the password reset workflow. The ResetPassword() function lacks conditional logic to verify the user's previous account status before modifying it. Instead of preserving the disabled state or rejecting password reset requests for disabled accounts, the function blindly sets the status to active for all users completing the reset flow.

Attack Vector

The attack is network-based and requires low privileges since the attacker needs only a valid email address associated with a disabled account. An attacker whose account has been disabled by an administrator can:

1. Navigate to the password reset functionality
2. Request a reset token for their disabled account email via the /api/v1/user/password/token endpoint
3. Receive the reset token (the system does not check account status when issuing tokens)
4. Complete the password reset via /api/v1/user/password/reset with the new password
5. Upon successful reset, the account status is changed from disabled to active
6. The attacker can now authenticate and access the platform despite administrator-imposed restrictions

This vulnerability allows bypassing administrative account controls entirely, as the legitimate security measure of disabling accounts becomes ineffective against users who can access the associated email address.

Detection Methods for CVE-2026-33316

Indicators of Compromise

• Successful login events from user accounts that were previously disabled
• Password reset completion events followed by immediate login activity for accounts in disabled state
• API calls to /api/v1/user/password/token and /api/v1/user/password/reset for accounts with disabled status
• Audit log entries showing account status changes from disabled to active without administrator action

Detection Strategies

• Monitor authentication logs for login attempts by accounts that should be in disabled state
• Implement alerting on password reset completions for accounts with non-active statuses
• Review user account status change events that occur outside of administrative workflows
• Cross-reference password reset API activity with user account status in the database

Monitoring Recommendations

• Enable detailed logging for all password reset API endpoints
• Configure alerts for any account status transitions from disabled to active
• Implement periodic audits of disabled accounts to verify they remain in the expected state
• Monitor for unusual patterns of password reset requests targeting disabled accounts

How to Mitigate CVE-2026-33316

Immediate Actions Required

• Upgrade Vikunja to version 2.2.0 or later immediately
• Audit all user accounts to identify any disabled accounts that may have been reactivated unexpectedly
• Review authentication logs for signs of exploitation against previously disabled accounts
• Consider temporarily disabling password reset functionality until the patch is applied

Patch Information

Vikunja version 2.2.0 addresses this vulnerability by implementing proper account status validation during the password reset process. The fix ensures that disabled accounts cannot be reactivated through the password reset flow. Security patches are available through the official Vikunja GitHub repository:

• GitHub Commit Update
• GitHub Commit Change
• GitHub Security Advisory
• Vikunja Release Changelog

Workarounds

• Disable the password reset functionality at the application or proxy level until patching is complete
• Implement additional access controls at the network layer to restrict access to the password reset endpoints
• Delete email addresses associated with disabled accounts to prevent token generation
• Monitor and manually re-disable any accounts found to be unexpectedly reactivated

# Configuration example
# Block password reset endpoints at the reverse proxy level (nginx example)
location /api/v1/user/password/token {
    deny all;
    return 403;
}

location /api/v1/user/password/reset {
    deny all;
    return 403;
}