A flaw in the API token validation routine allows disabled or locked users to retain effective access to shared projects. The vulnerability is triggered by the fact that token validation only considers the status of the bot account that created the token, not the original user’s status. Consequently, an attacker who holds a pre‑minted bot token can read and modify data through the HTTP API, CalDAV, MCP, and feeds even after the real user account has been deactivated.

Vikunja versions from 2.4.0 up to and including 2.7.0 are affected. Any deployment using these releases is vulnerable, regardless of operating system or external hosting environment. The issue lies in the Vikunja application code and does not depend on third‑party components.

The CVSS score of 5.3 places this issue in the medium severity range. The EPSS score is not available, so the real likelihood of exploitation is uncertain, but the vulnerability is not listed in CISA KEV, suggesting no widespread exploitation has been observed yet. Attackers can exploit the flaw by using an existing bot API token after disabling or locking the original user account, thus bypassing intended authentication controls. Because the vulnerability stems from incorrect access‑control checks, it can be leveraged in any environment where bot tokens are used to grant access to shared resources.