Vikunja before version 2.7.1 places live password‑reset, email‑confirmation and account‑deletion tokens directly into the query string of email links. When a user opens such a link, the full request URI—including the token—is written to the web server’s access logs and any reverse‑proxy logs. An attacker who can read those log files can capture an unredeemed token and replay it to reset a password or confirm an account‑deletion request, effectively gaining control of or destroying the targeted account.

All installations of Vikunja running any version earlier than 2.7.1 are affected. The issue is documented for the go‑vikunja:vikunja product. No further product or vendor variants are listed; the vulnerability stems from the core application code shared across all supported distributions.

The CVSS score of 8.4 signifies a high severity that can result in unauthorized account control. While an EPSS score is not available, the absence of a listing in CISA’s KEV database does not diminish the threat. Attackers require only read access to the server’s or reverse proxy’s access logs, a condition that can be satisfied by any staff member or compromised user with standard log‑reading privileges. Once a valid token is captured, exploitation is straightforward and deterministic, involving a simple replay of the intercepted request.