A flaw in the Vikunja task‑management platform allows users whose accounts are marked disabled or locked to authenticate through API tokens, CalDAV basic authentication, and OpenID Connect. Because the status check is only applied to local logins and JWT token refreshes, these alternate authentication paths do not enforce the disabled/locked flag, meaning that such accounts can still access data that should otherwise be inaccessible. This effectively elevates the attacker’s privileges to that of a legitimate authenticated user, posing risk to data confidentiality and integrity.

The vulnerability affects the self‑hosted Vikunja platform from version 0.18.0 through 2.2.0 inclusive. All deployments of the package identified by the vendor go-vikunja up to and including the 2.2.0 release are susceptible until the application is updated to version 2.2.1 or later, which restores proper status checks for all authentication pathways.

With a CVSS score of 7.1 the issue is categorized as medium‑high severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. However, based on the description, it is inferred that an attacker can remotely exploit the flaw by supplying a valid API token, CalDAV credentials, or OpenID Connect cookies, thereby bypassing the disabled/locked status and gaining unauthorized access to the system.