CVE-2026-123521

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.7.1

Description An improper restriction of excessive authentication attempts allows session holders to brute-force account passwords through unthrottled re-authentication endpoints. An attacker possessing a stolen session can guess the password via the '/user/settings/totp/disable' endpoint without triggering a lockout, subsequently disabling Time-based One-Time Password (TOTP) authentication without a code to achieve persistent account takeover.

Recommendations Update to version 2.7.1 or later. Restrict access to the '/user/settings/totp/disable' endpoint as a temporary mitigation measure.