CVE-2026-28268: go-vikunja vikunja Incomplete Cleanup

Vulnerability summary

CVE-2026-28268 is a critical (CVSS 9.8) Incomplete Cleanup vulnerability in go-vikunja vikunja. EPSS estimates a 0.91% chance of exploitation in the next 30 days, higher than 59.6% of scored vulnerabilities.

Timeline

1. 27-02-2026
   PublishedVulnerability first disclosed.
2. 03-03-2026
   Last modifiedVulnerability information updated.

Description

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever. This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls. Version 2.1.0 contains a patch for the issue.

• CWE-459Incomplete CleanupThe product does not properly "clean up" and remove temporary or supporting resources after they have been used.
• CWE-640Weak Password Recovery Mechanism for Forgotten PasswordThe product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.