Vikunja’s CalDAV endpoint incorrectly accepts Basic Authentication credentials before requiring the two‑factor authentication (TOTP) challenge, allowing an attacker who knows a user’s login name and password to retrieve any project data normally protected by 2FA. This vulnerability is a classic authentication bypass (CWE‑288) and can expose sensitive project names, descriptions and potentially other protected information. The CVSS base score of 6.9 indicates a moderate severity, suggesting that a successful exploitation can compromise confidentiality and integrity of data while requiring only network access.

All installations of the go‑vikunja:vikunja product running a version earlier than 2.2.0 are affected. Version 2.2.0 and later contain a patch that disables Basic Authentication for the CalDAV endpoint when 2FA is enabled, thereby restoring proper security checks.

The risk is moderate, reflected by the CVSS score of 6.9, and the vulnerability can be exploited remotely over the network. Since EPSS data is not available, the probability of exploitation cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. An attacker sends an unauthenticated Basic Auth request to the CalDAV URL, bypasses the TOTP verification, gains access to project resources, and can then read, modify or delete data as the authenticated user.