Executive Summary

CVE-2026-33668 is a security vulnerability in the Vikunja open-source task management platform affecting versions from 0.18.0 up to 2.2.0. The issue arises because when a user account is disabled or locked, the system only enforces this status check during local login and JWT token refresh. However, three other authentication methods—API tokens, CalDAV basic authentication, and OpenID Connect—do not verify if the user is disabled or locked. This allows disabled or locked users to continue accessing the API and syncing data, effectively bypassing account restrictions.

The root cause is that the user status checks were missing or incomplete in these authentication paths, allowing unauthorized access. The vulnerability was fixed in version 2.2.1 by adding explicit checks for disabled or locked user status in all authentication methods, ensuring that such users are rejected by default.

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': 'This vulnerability can have significant security impacts by allowing disabled or locked user accounts to continue accessing the system through API tokens, CalDAV synchronization, and OpenID Connect authentication. Specifically:'}, {'type': 'list_item', 'content': 'Disabled or locked users can still make API requests using previously issued API tokens, which may remain valid for long periods.'}, {'type': 'list_item', 'content': 'Such users can continue syncing calendars and tasks via CalDAV basic authentication without restriction.'}, {'type': 'list_item', 'content': 'Users can re-authenticate via OpenID Connect and obtain valid JWT tokens despite their account being disabled or locked.'}, {'type': 'paragraph', 'content': "This means administrators' attempts to immediately lock out users by disabling accounts are ineffective, potentially leading to unauthorized access, data leakage, or misuse of system resources."}] [4]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability involves disabled or locked user accounts still being able to authenticate and access the system via API tokens, CalDAV basic authentication, and OpenID Connect, bypassing intended restrictions.'}, {'type': 'paragraph', 'content': 'To detect this vulnerability on your system, you should monitor authentication attempts and API usage for disabled or locked user accounts. Specifically, check if API tokens or CalDAV requests are succeeding for users whose accounts have been disabled or locked.'}, {'type': 'paragraph', 'content': 'Suggested commands or approaches include:'}, {'type': 'list_item', 'content': "Query your Vikunja database or user management system to list users with status 'disabled' or 'locked'."}, {'type': 'list_item', 'content': 'Monitor API logs for requests authenticated with API tokens belonging to disabled or locked users.'}, {'type': 'list_item', 'content': 'Check CalDAV authentication logs for successful authentications by disabled or locked users.'}, {'type': 'list_item', 'content': 'Review OpenID Connect authentication logs to verify if disabled or locked users are obtaining JWT tokens.'}, {'type': 'paragraph', 'content': 'Since the vulnerability is related to missing user status checks in certain authentication paths, you can also test by attempting to authenticate using API tokens, CalDAV, or OIDC with a disabled or locked user account and observe if access is granted.'}] [4, 2]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and recommended mitigation is to upgrade Vikunja to version 2.2.1 or later, where the vulnerability is patched by enforcing user status checks across all authentication paths.

Until the upgrade can be applied, consider the following steps:

• Manually revoke or expire API tokens for disabled or locked users to prevent continued API access.
• Temporarily disable or restrict CalDAV and OpenID Connect authentication mechanisms if possible.
• Monitor and audit authentication logs to detect and block unauthorized access by disabled or locked accounts.

These steps help reduce the risk of unauthorized access while awaiting the official patch.

Useful 0 Not Useful 0