CVE-2026-33315: Vikunja has a 2FA Bypass via Caldav Basic Auth

Analyzed

AliasesGHSA-47cr-f226-r4pqGO-2026-4794

Published 24-03-2026Last modified 24-03-2026

Vulnerability summary

CVE-2026-33315 is a medium (CVSS 6.9) vulnerability in go-vikunja vikunja. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.6% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

38/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.9/10

010

Medium · v4.0 (CVE.org)

EPSS score

0.46%

0%100%

Low · +0.16 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Advisory lineage

Upstream 0 · Downstream 2 · Related 2

OPENSUSE-SU-2026:21483-1 SUSE-SU-2026:1135-1

Timeline

24-03-2026
PublishedVulnerability first disclosed.
24-03-2026
Last modifiedVulnerability information updated.

Description

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, the Caldav endpoint allows login using Basic Authentication, which in turn allows users to bypass the TOTP on 2FA-enabled accounts. The user can then access standard project information that would normally be protected behind 2FA (if enabled), such as project name, description, etc. Version 2.2.0 patches the issue.