What is GHSA-9j2r-8c48-g92c?

GHSA-9j2r-8c48-g92c is a security advisory published by GitHub Security Advisories with Medium severity. Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows...

Which CVE IDs does GHSA-9j2r-8c48-g92c cover?

GHSA-9j2r-8c48-g92c covers the following CVE IDs: CVE-2026-123493. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9j2r-8c48-g92c?

GHSA-9j2r-8c48-g92c has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-9j2r-8c48-g92cMediumCVSS 5.4

Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-123493 →

📋 Description

Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading and modifying shared projects via the HTTP API, CalDAV, MCP and feeds.

🔗 References (4)

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-5fc2-w2j4-6r8w
https://nvd.nist.gov/vuln/detail/CVE-2026-123493
https://www.vulncheck.com/advisories/vikunja-from-2.4.0-before-2.7.1-authentication-bypass-via-bot-api-tokens
https://github.com/advisories/GHSA-9j2r-8c48-g92c