Threats tagged 'ghsa-9j2r-8c48-g92c'

Vikunja versions from 2.4.0 up to but not including 2.7.1 have an authentication bypass vulnerability. This flaw allows disabled or locked users to maintain access via API tokens associated with their bot users. The vulnerability arises because token validation only verifies the bot user's status, not the status of the original user. Attackers with pre-existing bot tokens can continue to read and modify shared projects through multiple interfaces including the HTTP API, CalDAV, MCP, and feeds.