Vikunja versions before 2.4.0 store sensitive password‑reset, email‑confirmation, and account‑deletion tokens in the user_tokens table as plaintext, creating a direct path for attackers to assume user accounts. If an adversary can read the database—through a backup leak, misconfigured storage, or a SQL‑level exposure—they can immediately use the exposed tokens to reset passwords or confirm email addresses without any password knowledge. This flaw falls under CWE‑312 (Plaintext Storage of Sensitive Data) and CWE‑916 (Information Exposure to Untrusted Entities). The potential impact is full account takeover, exposing all data and allowing further lateral movement within the environment.

The affected product is go‑vikunja Vikunja. All releases prior to v2.4.0 are vulnerable; the issue is fixed in v2.4.0 and later versions.

The vulnerability carries a CVSS score of 8.1, indicating high severity, and is not listed in CISA’s KEV catalog. The EPSS score is not available, but the required condition is only read access to the database. Once read access is achieved—via leaked backups, insecure configuration, or an SQL injection that grants data retrieval—the attacker can directly perform account takeover, making this flaw likely to be exploited in scenarios where database protection is weak. Prevention hinges on securing database access rather than preventing the database from being readable by attackers.