CVE-2026-33315
published 2026-03-24CVE-2026-33315: Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, the Caldav endpoint allows login using Basic Authentication, which in…
PriorityP426medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.30%
21.8th percentile
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, the Caldav endpoint allows login using Basic Authentication, which in turn allows users to bypass the TOTP on 2FA-enabled accounts. The user can then access standard project information that would normally be protected behind 2FA (if enabled), such as project name, description, etc. Version 2.2.0 patches the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.vikunja.io | api | 0 – 2.1.0 | — |
| go-vikunja | vikunja | < 2.2.0 | 2.2.0 |
| vikunja | vikunja | < 2.2.0 | 2.2.0 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api
osv·2026-03-23
CVE-2026-33315 Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api
Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api
Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api
GHSA
Vikunja has a 2FA Bypass via Caldav Basic Auth
ghsa·2026-03-20
CVE-2026-33315 [MEDIUM] CWE-288 Vikunja has a 2FA Bypass via Caldav Basic Auth
Vikunja has a 2FA Bypass via Caldav Basic Auth
### Summary
The Caldav endpoint allows login using Basic Authentication, which in turn allows users to bypass the TOTP on 2FA-enabled accounts. The user can then access standard project information that would normally be protected behind 2FA (if enabled), such as project name, description, etc.
### Details
The two files below show that when a user is accessing Caldav via Basic Authentication, it skips all steps involving 2FA. The order of operations is essentially:
1. Retrieve basic credentials.
2. Verify username.
3. Verify password.
4. Success
**pkg/routes/caldav/auth.go:45**
```go
u, err := checkUserCaldavTokens(s, credentials)
if user.IsErrUserDoesNotExist(err) {
return false, nil
}
if u == nil {
u, err = user.CheckUserCredentials(s, cr
OSV
Vikunja has a 2FA Bypass via Caldav Basic Auth
osv·2026-03-20
CVE-2026-33315 [MEDIUM] Vikunja has a 2FA Bypass via Caldav Basic Auth
Vikunja has a 2FA Bypass via Caldav Basic Auth
### Summary
The Caldav endpoint allows login using Basic Authentication, which in turn allows users to bypass the TOTP on 2FA-enabled accounts. The user can then access standard project information that would normally be protected behind 2FA (if enabled), such as project name, description, etc.
### Details
The two files below show that when a user is accessing Caldav via Basic Authentication, it skips all steps involving 2FA. The order of operations is essentially:
1. Retrieve basic credentials.
2. Verify username.
3. Verify password.
4. Success
**pkg/routes/caldav/auth.go:45**
```go
u, err := checkUserCaldavTokens(s, credentials)
if user.IsErrUserDoesNotExist(err) {
return false, nil
}
if u == nil {
u, err = user.CheckUserCredentials(s, cr
No detection rules found.
No public exploits indexed.
2026-03-24
Published