Vikunja’s password reset logic incorrectly clears the disabled flag when a reset is performed, allowing any user who can request a reset token to reactivate an account that an administrator had disabled. This flaw permits previously disabled, potentially privileged users to regain access, thereby compromising the integrity of account management and providing a vector for privilege escalation. The weakness falls under improper access control, as the system fails to enforce the user’s disabled state during reset operations.

All versions of Vikunja released before 2.2.0 are vulnerable. The issue exists in the open‑source self‑hosted application provided by the vikunja vendor. Administrators who rely on account disabling for security should be aware that disabling is ineffective until environment is updated.

The vulnerability scores a CVSS of 8.1, indicating high severity. No EPSS data is available, and it is not listed in the CISA KEV catalog, but the flaw is publicly known and easily exploitable via the publicly documented /api/v1/user/password/token and /api/v1/user/password/reset endpoints. An attacker only needs the ability to obtain or guess an email address associated with the account to trigger a reset, making the attack vector likely remote and low in preparation effort.