CVE-2026-33315
MEDIUM
vikunja
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Mar 24, 2026
Vendor
vikunja
Description
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, the Caldav endpoint allows login using Basic Authentication, which in turn allows users to bypass the TOTP on 2FA-enabled accounts. The user can then access standard project information that would normally be protected behind 2FA (if enabled), such as project name, description, etc. Version 2.2.0 patches the issue.