CVSS 8.1: Vikunja 2.4.0 Patches Plaintext Token Leak Enabling Account Takeover

Vikunja version 2.4.0 resolves a high-severity vulnerability that allowed attackers to hijack user accounts by reading plaintext tokens from the database. The issue, tracked as CVE-2026-62376, affects all versions of the open-source task management platform prior to 2.4.0. According to the National Vulnerability Database, the flaw carries a CVSS score of 8.1, indicating significant risk for self-hosted instances with exposed data stores.

How does the plaintext token flaw work?

Vikunja versions before 2.4.0 stored password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table without hashing. The `genToken` function in `pkg/user/token.go` saved the raw random string directly to the database. This contrasts with CalDAV tokens, which correctly used bcrypt hashing. An attacker with read access to the database could retrieve these unencrypted strings and use them to reset passwords or delete accounts without knowing the original credentials.

What is the impact of CVE-2026-62376?

An attacker who gains read access to the database can take over any user account with a pending token. The vulnerability allows immediate exploitation of password-reset, email-confirmation, and account-deletion functions. According to the GitHub advisory, this includes administrative accounts. The tokens remain valid for 24 hours, providing a window for exploitation if the database is compromised through a leaked backup, misconfigured cloud storage, or SQL injection.

What evidence confirms the vulnerability?

The GitHub security advisory provides a proof-of-concept demonstrating the risk. An attacker can execute a SQL query to join the `user_tokens` and `users` tables, extracting emails and plaintext tokens. Using the retrieved token, the attacker sends a POST request to the password-reset API endpoint. This grants full account access. The National Vulnerability Database cites CWE-312 (Cleverness in Cleartext Storage) and CWE-916 (Improper Export of Internal Data) as the underlying weaknesses.

What is the fix for this issue?

Vikunja version 2.4.0 fixes the issue by replacing the `genToken` function with `generateHashedToken` for password-reset, email-confirmation, and account-deletion tokens. This ensures tokens are hashed before storage, preventing direct reuse if the database is compromised. Users running versions prior to 2.4.0 should upgrade immediately. No other patches or workarounds are confirmed by the vendor.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe: Vikunja

• Upgrade Vikunja to version 2.4.0 or later to apply the vendor-provided fix for plaintext token storage.
• Audit database access controls to ensure only authorized services and administrators have read permissions.
• Review cloud storage configurations for database backups to prevent accidental public exposure.
• Monitor logs for unusual password-reset or account-deletion activity that may indicate token misuse.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Vikunja versions are affected by CVE-2026-62376?

All versions of Vikunja prior to 2.4.0 are affected by this vulnerability.

What is the CVSS score for this vulnerability?

The National Vulnerability Database assigns a CVSS score of 8.1, rated as high severity.

Can an attacker exploit this without knowing user passwords?

Yes, an attacker with database read access can use plaintext tokens to reset passwords or delete accounts.