CVE-2026-62376: go-vikunja vikunja
Vulnerability summary
CVE-2026-62376 is a high (CVSS 8.1) vulnerability in go-vikunja vikunja. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11.1% of scored vulnerabilities.
Timeline
- 09-10-2026PublishedVulnerability first disclosed.
- 13-10-2026Last modifiedVulnerability information updated.
Description
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over user accounts without knowing passwords. Version 2.4.0 fixes the issue.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
- CWE-916Use of Password Hash With Insufficient Computational EffortThe product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
Affected systems
Code.vikunja.io1 product
- api< 2.4.0 | All versions (No fix recorded)
Go-vikunja1 product
- vikunja< 2.4.0
2 vendors · 2 products