Security Advisory

CVE-2026-33315

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-03-24 14:53:34

Last updated 2026-03-24 15:33:55

Assigner GitHub_M

CVSS score 6.9

State PUBLISHED

Description

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, the Caldav endpoint allows login using Basic Authentication, which in turn allows users to bypass the TOTP on 2FA-enabled accounts. The user can then access standard project information that would normally be protected behind 2FA (if enabled), such as project name, description, etc. Version 2.2.0 patches the issue.

← Browse all CVEs View on cve.org ↗