Vikunja Before 2.6.0 Authentication Bypass Via Caldav Basicauth

Back www.vulncheck.com

Vikunja Before 2.6.0 Authentication Bypass Via Caldav Basicauth

www.vulncheck.com • September 16, 2026

Share: View original

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vikunja Authentication Bypass Vulnerabilities Discovered Two critical authentication bypass vulnerabilities have been identified in Vikunja versions prior to 2.6.0. The first vulnerability allows unauthorized access via Caldav Basic Authentication, while the second exploits an unthrottled API. These vulnerabilities could potentially allow attackers to gain unauthorized access to sensitive data. Organizations using affected versions are at risk, particularly those relying on Caldav for calendar management and API integrations. No specific CVEs have been assigned yet, but immediate action is advised for users to mitigate risks. Both vulnerabilities were disclosed on September 16, 2026, and are currently unpatched. Security teams are urged to monitor for further updates and apply patches as soon as they are available. 2 sources 51

Extracted Entities

CWE Weaknesses (1)

CWE-287 - Improper Authentication

Vulnerabilities (1)

CalDAV BasicAuth Vulnerability