CVE-2026-33316: Vikunja Auth Bypass Vulnerability

CVE-2026-33316 Overview

CVE-2026-33316 is an authentication bypass vulnerability in Vikunja, an open-source self-hosted task management platform. A critical flaw in Vikunja's password reset logic allows disabled users to regain access to their accounts by exploiting the ResetPassword() function, which sets the user's status to StatusActive after a successful password reset without verifying whether the account was previously disabled by an administrator.

Critical Impact
Disabled users can bypass administrator-imposed account restrictions and reactivate their accounts through the password reset flow, potentially leading to unauthorized access to sensitive task management data and organizational workflows.

Affected Products

Vikunja versions prior to 2.2.0
Self-hosted Vikunja instances with user account management enabled
Vikunja deployments using the built-in password reset functionality

Discovery Timeline

2026-03-24 - CVE-2026-33316 published to NVD
2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33316

Vulnerability Analysis

This authentication bypass vulnerability (CWE-284: Improper Access Control) exists in Vikunja's password reset implementation. The core issue stems from the ResetPassword() function unconditionally setting a user's account status to StatusActive upon successful password reset completion. This implementation fails to preserve the previous account state, specifically ignoring whether an administrator had intentionally disabled the user account.

The attack flow involves two API endpoints: first, the attacker requests a password reset token via /api/v1/user/password/token, and then completes the reset process via /api/v1/user/password/reset. Upon completion, the function activates the account regardless of its prior disabled state, effectively circumventing administrative security controls.

Root Cause

The root cause is a missing state validation check in the password reset workflow. The ResetPassword() function lacks conditional logic to verify the user's previous account status before modifying it. Instead of preserving the disabled state or rejecting password reset requests for disabled accounts, the function blindly sets the status to active for all users completing the reset flow.

Attack Vector

The attack is network-based and requires low privileges since the attacker needs only a valid email address associated with a disabled account. An attacker whose account has been disabled by an administrator can:

Navigate to the password reset functionality
Request a reset token for their disabled account email via the /api/v1/user/password/token endpoint
Receive the reset token (the system does not check account status when issuing tokens)
Complete the password reset via /api/v1/user/password/reset with the new password
Upon successful reset, the account status is changed from disabled to active
The attacker can now authenticate and access the platform despite administrator-imposed restrictions

This vulnerability allows bypassing administrative account controls entirely, as the legitimate security measure of disabling accounts becomes ineffective against users who can access the associated email address.

Detection Methods for CVE-2026-33316

Indicators of Compromise

Successful login events from user accounts that were previously disabled
Password reset completion events followed by immediate login activity for accounts in disabled state
API calls to /api/v1/user/password/token and /api/v1/user/password/reset for accounts with disabled status
Audit log entries showing account status changes from disabled to active without administrator action

Detection Strategies

Monitor authentication logs for login attempts by accounts that should be in disabled state
Implement alerting on password reset completions for accounts with non-active statuses
Review user account status change events that occur outside of administrative workflows
Cross-reference password reset API activity with user account status in the database

Monitoring Recommendations

Enable detailed logging for all password reset API endpoints
Configure alerts for any account status transitions from disabled to active
Implement periodic audits of disabled accounts to verify they remain in the expected state
Monitor for unusual patterns of password reset requests targeting disabled accounts

How to Mitigate CVE-2026-33316

Immediate Actions Required

Upgrade Vikunja to version 2.2.0 or later immediately
Audit all user accounts to identify any disabled accounts that may have been reactivated unexpectedly
Review authentication logs for signs of exploitation against previously disabled accounts
Consider temporarily disabling password reset functionality until the patch is applied

Patch Information

Vikunja version 2.2.0 addresses this vulnerability by implementing proper account status validation during the password reset process. The fix ensures that disabled accounts cannot be reactivated through the password reset flow. Security patches are available through the official Vikunja GitHub repository:

Workarounds

Disable the password reset functionality at the application or proxy level until patching is complete
Implement additional access controls at the network layer to restrict access to the password reset endpoints
Delete email addresses associated with disabled accounts to prevent token generation
Monitor and manually re-disable any accounts found to be unexpectedly reactivated

bash

# Configuration example
# Block password reset endpoints at the reverse proxy level (nginx example)
location /api/v1/user/password/token {
    deny all;
    return 403;
}

location /api/v1/user/password/reset {
    deny all;
    return 403;
}