{"id":"EUVD-2026-78649","enisaUuid":"fc7533ab-7b8a-3401-8e6f-04b467908b74","description":"Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance\u0027s anti-brute-force controls and compromise password-only accounts.","datePublished":"Sep 15, 2026, 3:18:23 PM","dateUpdated":"Sep 15, 2026, 3:55:04 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m469-88xx-8rx2\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-authentication-bypass-via-caldav-basicauth\n","aliases":"CVE-2026-91973\nGHSA-p2vv-wrh8-x466\nGHSA-m469-88xx-8rx2\n","assigner":"VulnCheck","epss":0.67,"enisaIdProduct":[{"id":"ef7d6265-e7ca-37e3-bee9-b5988528b971","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"0 \u003c2.6.0"}],"enisaIdVendor":[{"id":"791c3434-1be9-3d26-94f8-f3434c507a65","vendor":{"name":"go-vikunja"}}],"enisaIdVulnerability":[{"id":"8a7c164a-d35c-34f6-9dda-2e8444b7f4e5","vulnerability":{"id":"CVE-2026-91973","description":"Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance\u0027s anti-brute-force controls and compromise password-only accounts.","datePublished":"Sep 15, 2026, 3:18:23 PM","dateUpdated":"Sep 15, 2026, 3:55:04 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m469-88xx-8rx2\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-authentication-bypass-via-caldav-basicauth\n","enisa_id":"EUVD-2026-78649\n","assigner":"VulnCheck","epss":0.67,"dataProcessed":"Nov 7, 2026, 7:21:11 AM","vulnerabilityProduct":[{"id":"d86972cb-89bb-3759-94aa-e68685f8db5b","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"0 \u003c2.6.0"}],"vulnerabilityVendor":[{"id":"c8a7428c-60a8-3ce2-b26e-25d5a4540baa","vendor":{"name":"go-vikunja"}}]}},{"id":"91d79f2b-2f09-3365-90b3-f99367d5f0d9","vulnerability":{"id":"GHSA-p2vv-wrh8-x466","description":"Duplicate Advisory: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords","datePublished":"Sep 15, 2026, 6:32:30 PM","dateUpdated":"Oct 9, 2026, 8:51:57 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m469-88xx-8rx2\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91973\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-authentication-bypass-via-caldav-basicauth\n","enisa_id":"EUVD-2026-78649\n","aliases":"GHSA-p2vv-wrh8-x466\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9f0a4357-7b1f-3d0b-b075-5c7fa071bc32","vulnerability":{"id":"GHSA-m469-88xx-8rx2","description":"Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords","datePublished":"Oct 9, 2026, 8:52:04 PM","dateUpdated":"Oct 9, 2026, 8:52:04 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m469-88xx-8rx2\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91973\nhttps://github.com/go-vikunja/vikunja/pull/3688\nhttps://github.com/go-vikunja/vikunja\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.6.0\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-authentication-bypass-via-caldav-basicauth\n","enisa_id":"EUVD-2026-78649\n","aliases":"CVE-2026-91973\nGHSA-m469-88xx-8rx2\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}