Vikunja Patch Fixes Plaintext Token Storage Vulnerability CVE-2026-62376

Vikunja has released version 2.4.0 to address a high-severity vulnerability that allowed attackers to take over user accounts by exploiting plaintext storage of sensitive tokens. The flaw, tracked as CVE-2026-62376, affected all versions of the open-source task management platform prior to the update.

The vulnerability stems from how Vikunja handled specific authentication tokens. According to the GitHub advisory GHSA-r6w9-259g-gwrv, the application stored password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` database table in plaintext. This occurred because the `genToken()` function in `pkg/user/token.go` saved the raw random string directly without hashing. In contrast, CalDAV tokens within the same application correctly used bcrypt hashing via `generateHashedToken`.

Context and Background

The National Vulnerability Database (NVD) assigns a CVSS score of 8.1 to CVE-2026-62376, classifying it as high severity. The NVD identifies the underlying weaknesses as CWE-312 (Cleartext Storage of Sensitive Information) and CWE-916 (Use of Password Hash With Insufficient Computational Effort), though the primary issue is the lack of hashing for these specific token types.

To validate a token, the application performed a direct equality check against the plaintext value stored in the database. This design meant that any entity with read access to the database could retrieve active tokens immediately. The tokens remained valid for up to 24 hours. An attacker could use a leaked password-reset token to change a user's password, effectively gaining full control of the account, including administrative privileges if the compromised account held such rights.

Who Is Affected

The vulnerability impacts self-hosted installations of Vikunja running version 2.3.0 or earlier. The risk materializes if an attacker gains read access to the database. According to the advisory, this access could occur through leaked backups, misconfigured cloud storage, or SQL injection vulnerabilities that expose the `user_tokens` table.

The advisory provides a proof-of-concept demonstrating how an attacker could extract email addresses and corresponding plaintext tokens using a simple SQL query. Once obtained, these tokens could be used in API calls to reset passwords without knowing the original credentials. The fix in version 2.4.0 replaces the plaintext generation method with hashed token generation for the affected token types: password reset, email confirmation, and account deletion.

What should you do?

Administrators running Vikunja should verify their current version immediately. If the installation is older than 2.4.0, users should upgrade to the patched version as soon as possible. Because the vulnerability relies on database read access, organizations should also review their database security posture, ensuring that backups and storage configurations are not publicly accessible.