Executive Summary

This vulnerability exists in Vikunja, an open-source self-hosted task management platform, prior to version 2.2.0. The issue is that the Caldav endpoint allows login using Basic Authentication, which enables users to bypass the Time-based One-Time Password (TOTP) on accounts that have two-factor authentication (2FA) enabled.

As a result, an attacker or unauthorized user can access project information such as project name and description that should normally be protected by 2FA. This bypass undermines the security provided by 2FA on the platform.

The vulnerability was patched in version 2.2.0 of Vikunja.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized access to project information that should be protected by two-factor authentication.

If you have 2FA enabled on your Vikunja account, an attacker could bypass this protection via the Caldav endpoint using Basic Authentication, gaining access to sensitive project details such as project names and descriptions.

This could lead to exposure of confidential project information, potentially compromising privacy and security within your organization.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Vikunja to version 2.2.0 or later, as this version patches the issue where the Caldav endpoint allows bypassing TOTP on 2FA-enabled accounts.

Useful 0 Not Useful 0