CVE-2026-33315

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-33315

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33315.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-33315

Aliases

Downstream

SUSE-SU-2026:1135-1

Related

SUSE-SU-2026:1135-1

Published

2026-03-24T14:53:34.375Z

Modified

2026-07-15T01:49:06.674561980Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Vikunja has a 2FA Bypass via Caldav Basic Auth

Details

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, the Caldav endpoint allows login using Basic Authentication, which in turn allows users to bypass the TOTP on 2FA-enabled accounts. The user can then access standard project information that would normally be protected behind 2FA (if enabled), such as project name, description, etc. Version 2.2.0 patches the issue.

Database specific

{
    "cwe_ids": [
        "CWE-288"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33315.json"
}

References

Affected packages

Git / github.com/go-vikunja/vikunja

Affected ranges

Type

GIT

Repo

https://github.com/go-vikunja/vikunja

Events

Introduced

Fixed

b365be1881641dd2791d3dff4c26ad941c13cef6

Fixed

cdf5d30a425d032f749b78b98b828f25ad882615

Database specific

{
    "cpe": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.2.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.1

v0.10

v0.11

v0.12

v0.13

v0.14.0

v0.15.0

v0.16.0

v0.17.0

v0.18.0

v0.18.1

v0.19.0

v0.19.1

v0.19.2

v0.2

v0.20.0

v0.20.1

v0.20.3

v0.20.4

v0.21.0

v0.22.0

v0.22.1

v0.23.0

v0.24.1

v0.3

v0.4

v0.5

v0.6

v0.7

v0.8

v0.9

v1.*

v1.0.0

v1.0.0-rc0

v1.0.0-rc1

v1.0.0-rc2

v1.0.0-rc3

v1.0.0-rc4

v1.1.0

v2.*

v2.0.0

v2.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33315.json"