CVE-2026-62376: CWE-312: Cleartext Storage of Sensitive Information in go-vikunja vikunja

CVE-2026-62376 describes a vulnerability in the open-source task management platform Vikunja where sensitive tokens for password reset, email confirmation, and account deletion are stored in plaintext in the user_tokens table in versions before 2.4.0. An attacker who gains read access to the database, for example through backup leaks, misconfigured storage, or SQL-level exposure, can leverage these tokens to hijack user accounts without requiring password knowledge. This issue is addressed and fixed in Vikunja version 2.4.0.

If exploited, this vulnerability allows an attacker with read access to the database to immediately take over user accounts by using plaintext tokens, leading to full confidentiality, integrity, and availability compromise of affected accounts. The CVSS 3.1 score of 8.1 reflects a high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required.

Upgrade Vikunja to version 2.4.0 or later, where the issue is fixed by no longer storing sensitive tokens in plaintext. Until upgraded, restrict and monitor database access to prevent unauthorized read access to the user_tokens table.