Vikunja versions prior to 2.7.1 have a missing authentication check that allows anyone with a stolen session cookie to enroll and enable TOTP using a secret of their choice. This step‑up authentication bypass lets the attacker lock the legitimate account out, a state that persists even after the owner resets their password. The exploitation exposes the account to full takeover and is a classic example of the improper use of authentication controls identified as CWE-306.

The affected product is Vikunja, specifically all releases before version 2.7.1. No additional vendor or component version details were provided, but any installation of Vikunja that has not upgraded beyond 2.7.1 is vulnerable.

The vulnerability carries a CVSS score of 6, indicating moderate severity. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires an attacker to already possess a valid session cookie, so the attack vector is limited to authenticated sessions that have been compromised or intercepted. Once the attacker achieves session possession, they can invoke the TOTP enrollment and enable endpoints to lock the account, making CVE‑2026‑123530 a notable risk for environments that rely on TOTP for multi‑factor authentication.