CVE-2026-62376

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.4.0

Description Vikunja stores password-reset, email-confirmation, and account-deletion tokens in plaintext within the user tokens table. The genToken() function in pkg/user/token.go saves raw random strings without hashing, and the getToken() function performs lookups using plaintext equality. If an attacker obtains read access to the database via backup leaks, misconfigured storage, or SQL-level exposure, they can use these pending tokens to take over user accounts, including administrator accounts, without knowing the passwords. This issue affects the TokenPasswordReset, TokenEmailConfirm, and TokenAccountDeletion token types.

Recommendations Update to version 2.4.0.