CVE-2026-33668

CVE-2026-33668 impacts Vikunja, an open-source self-hosted task management platform, specifically versions 0.18.0 through 2.2.0. The vulnerability allows disabled or locked user accounts to bypass status checks on API tokens, CalDAV basic authentication, and OpenID Connect paths, thereby retaining unauthorized access to the API and data. With a CVSS score of 8.1 (HIGH), this flaw has a low attack complexity and can be exploited remotely by a low-privileged user, resulting in high impact on confidentiality and integrity. Despite its severity, there is no evidence of active exploitation, no public exploit code available, and minimal community discussion or media coverage, reflected in its very low EPSS score and absence from the KEV catalog.