CVE-2026-33316

CVE-2026-33316 is a high-severity vulnerability affecting Vikunja, an open-source task management platform, in versions prior to 2.2.0. This flaw allows previously disabled user accounts to be reactivated by exploiting a weakness in the password reset logic, which incorrectly sets the user status to active without verifying prior disablement. With a CVSS score of 8.1, the vulnerability has a low attack complexity and can be exploited remotely by a disabled user to regain full access to their account, leading to high confidentiality and integrity impacts. There is currently no evidence of active exploitation, nor is public exploit code available. Organizations using affected Vikunja versions should prioritize upgrading to version 2.2.0 to mitigate this risk.