CVE-2026-123493 is an authentication-bypass flaw in the Vikunja project-management tool, affecting versions 2.4.0 up to 2.7.1, where disabling or locking a human user's account doesn't actually cut off their access if that user still holds an API token minted for one of their bot accounts. Because Vikunja only checks whether the bot itself is active rather than the owning human, anyone holding one of those pre-minted bot tokens can continue to browse and change shared project data across Vikunja's various interfaces, including its REST API, CalDAV sync, MCP integration, and web feeds. The fix shipped in version 2.7.1.
// source: nvd.nist.gov ↗