CVE-2026-62376 Details
Description
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over user accounts without knowing passwords. Version 2.4.0 fixes the issue.
A vulnerability in Vikunja versions prior to 2.4.0 allows for account takeover due to the storage of password-reset, email-confirmation, and account-deletion tokens in plaintext within the 'user_tokens' table. This issue can be exploited if an attacker gains read access to the database, such as through a leaked backup, misconfigured storage, or SQL injection. Exploitation involves using the exposed tokens to reset passwords and take over user accounts, including those of administrators.
Users can update to Vikunja version 2.4.0 or later, where this vulnerability has been fixed. Instructions for downloading the latest version are available on the Vikunja GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-r6w9-259g-gwrv | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/go-vikunja/vikunja/commit/00fd2c6155c01faae99be4226b931d8091fd6323 | [email protected] | Source CodeVendor |
| https://github.com/go-vikunja/vikunja/commit/3a0ea15d8c18ff960bc98ae39950fa7a14b0af7d | [email protected] | Source CodeVendor |
| https://github.com/go-vikunja/vikunja/commit/e31ea2de5040fa63bc97cf4df63bafed3bd9ad85 | [email protected] | Source CodeVendor |
| https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0 | [email protected] | Release NotesVendor |
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-r6w9-259g-gwrv | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-312 | Cleartext Storage of Sensitive Information | [email protected] |
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vikunja | <= 2.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |