VDB
CVE-2026-33315
CVE-2026-33315
PUBLISHED
CVSS 6.900000095367432 MEDIUM
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, the Caldav endpoint allows login using Basic Authentication, which in turn allows users to bypass the TOTP on 2FA-enabled accounts. The user can then access standard project information that would normally be protected behind 2FA (if enabled), such as project name, description, etc. Version 2.2.0 patches the issue.
EPSS 0.44% · 36.9th percentile
Risk Scores
CVSS 4.0
6.900000095367432
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.44%
36.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| vikunja | vikunja | 0, 0, 0 |
| go-vikunja | vikunja | < 2.2.0, < 2.2.0, < 2.2.0 |
| code.vikunja.io | api | 0, 0, 0 |
Timeline
- Mar 20, 2026 CVE Published
- Mar 20, 2026 PoC Published
- Mar 23, 2026 Security Advisory
- Mar 25, 2026 CVE Updated
- Mar 25, 2026 EPSS Score
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score
- May 24, 2026 EPSS Score
- May 25, 2026 EPSS Score
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-33315 advisory
- https://github.com/go-vikunja/vikunja package
- https://github.com/go-vikunja/vikunja/commit/cdf5d30a425d032f749b78b98b828f25ad882615 patch
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-47cr-f226-r4pq exploit
- https://vikunja.io/changelog/vikunja-v2.2.0-was-released technical