CVE-2026-123493

Vikunja bot tokens retain access after their owner is disabled

Vikunja · Vikunja API and MCP bot authentication

First documented disclosure · Review checkpoint

Summary

A bot token could keep reading and modifying shared projects after an administrator disabled or locked its human owner.

Severity and exploitation evidence

Medium · 5.4/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public disclosures do not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The authentication service checked the bot account but omitted the owner’s current status. MCP, the HTTP API, CalDAV and feeds shared the affected authentication logic.

Conditions required

The former account holder has a previously issued bot token and the bot still has permissions on shared resources.

Potential impact

The token can retain the permissions granted to the bot, including project data access and changes.

Affected versions and configurations

2.4.0 through 2.7.0.

Fix and mitigation status

2.7.1, as listed by the project and CNA.

Practical next steps

Upgrade to 2.7.1. Revoke existing bot credentials held by disabled users and review their project activity.

Operating lesson

When disabling an account, check the status of the owner whenever a delegated credential is used.

Evidence and limits

The maintainer’s advisory identifies the MCP exposure and release boundary.

Sources