{"id":8881,"date":"2026-11-13T14:25:55","date_gmt":"2026-11-13T14:25:55","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts"},"modified":"2026-11-13T14:25:55","modified_gmt":"2026-11-13T14:25:55","slug":"cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts","title":{"rendered":"CVE-2026-123493: Vikunja bot tokens bypass account lockouts, let disabled users keep access"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>What:<\/strong> Authentication bypass in Vikunja task management software allows disabled users to keep working through bot API tokens<\/li><li><strong>Affected versions:<\/strong> Vikunja 2.4.0 through 2.7.0<\/li><li><strong>Fixed in:<\/strong> Version 2.7.1<\/li><li><strong>Impact:<\/strong> Disabled or locked accounts can still read and modify shared projects via HTTP API, CalDAV, MCP and feeds<\/li><li><strong>What to do:<\/strong> Upgrade to Vikunja 2.7.1 and manually revoke bot tokens for disabled accounts<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">In plain English<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Vikunja is a task and project management tool. When an administrator disables or locks a user account (for example, when someone leaves the company or their account is compromised), that person can still access and change shared projects if they created a &#8220;bot user&#8221; and saved its access token beforehand. The system only checks whether the bot itself is disabled, not whether the human who owns the bot is disabled. If you run a Vikunja server, update to version 2.7.1 and manually delete bot tokens for any disabled accounts. If you only use Vikunja as a regular user and don&#8217;t run the server yourself, you don&#8217;t need to do anything.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Vikunja introduced bot users in version 2.4.0. Bot users are automation accounts that a human owner can create and generate API tokens for. When Vikunja checks an API token, it loads the bot user and verifies only that the bot itself is not disabled or locked. It does not check the status of the bot&#8217;s human owner.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When an administrator disables or locks a user account, Vikunja updates only that user&#8217;s database row. It does not cascade the status change to any bots owned by that user. As a result, every bot token minted before the owner was disabled continues to authenticate successfully.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An attacker (or a legitimately disabled user) holding a bot API token can continue to read and modify every project or team shared with the bot. This works across all Vikunja interfaces: the HTTP API (v1 and v2), CalDAV, MCP (Model Context Protocol) and RSS\/Atom feeds.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability was reported externally as TOK-BOT-01 and assigned CVE-2026-123493. The GitHub security advisory credits the reporter Cuong-VnC. The CVSS v4 score is 5.3 (Medium severity).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What you should do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Upgrade to Vikunja 2.7.1. The patch changes the authentication logic so that when the authenticating user is a bot, Vikunja also checks the owner&#8217;s status (Disabled, Locked, EmailConfirmationRequired). This makes the bot inherit its owner&#8217;s state without requiring a database cascade, so re-enabling the owner automatically restores the bots.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After upgrading, manually revoke API tokens for bots owned by disabled or locked accounts. The fix prevents future authentication but does not invalidate existing tokens.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What it means<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability undermines administrative account controls. When an admin disables a user for offboarding or incident response, they expect to cut off all access immediately. This bug leaves a backdoor: any bot tokens the user created remain valid indefinitely.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The impact is limited to users who created bots and minted tokens before being disabled, and only affects resources shared with those bots. It does not grant access to other users&#8217; private projects. However, in a team environment where bots are shared across projects, a single disabled account can retain broad read\/write access.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The fix in 2.7.1 closes the gap by tying bot authentication to the owner&#8217;s account status, ensuring that disabling an account immediately disables all automation owned by that account.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/github.com\/go-vikunja\/vikunja\/security\/advisories\/GHSA-5fc2-w2j4-6r8w\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub Security Advisory GHSA-5fc2-w2j4-6r8w<\/a><\/li><li><a href=\"https:\/\/www.vulncheck.com\/advisories\/vikunja-from-2.4.0-before-2.7.1-authentication-bypass-via-bot-api-tokens\" target=\"_blank\" rel=\"noreferrer noopener\">VulnCheck Advisory: Vikunja Authentication Bypass via Bot API Tokens<\/a><\/li><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-123493\" target=\"_blank\" rel=\"noreferrer noopener\">NVD CVE-2026-123493<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Vikunja versions 2.4.0 through 2.7.0 contain an authentication bypass that allows disabled or locked user accounts to retain full access through API tokens owned by their bot users, because token validation checks only the bot&#8217;s status and not the human owner&#8217;s.<\/p>\n","protected":false},"author":2,"featured_media":8880,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"65","_nx_sec_severity":"medium","_nx_sec_affected":"Vikunja 2.4.0 through 2.7.0","_nx_sec_status":"patch-available","_nx_sec_kicker":"ALERT: Disabled Vikunja accounts keep bot access","_nx_sec_type":"platform","_nx_sec_vendor":"Vikunja","_nx_sec_fixed":"2.7.1","_nx_sec_action":""},"categories":[65,12,28],"tags":[],"companies":[],"products":[],"class_list":["post-8881","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-security","category-policy-safety","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2026-123493: Vikunja Bot Token Bypass Vulnerability<\/title>\n<meta name=\"description\" content=\"CVE-2026-123493 in Vikunja 2.4.0\u20132.7.0 lets disabled users keep access via bot API tokens. Admins must revoke bot tokens manually. Patch in 2.7.1.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-123493: Vikunja Bot Token Bypass Vulnerability\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-123493 in Vikunja 2.4.0\u20132.7.0 lets disabled users keep access via bot API tokens. Admins must revoke bot tokens manually. Patch in 2.7.1.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-13T14:25:55+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"CVE-2026-123493: Vikunja bot tokens bypass account lockouts, let disabled users keep access\",\"datePublished\":\"2026-11-13T14:25:55+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts\"},\"wordCount\":593,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts-title.webp\",\"articleSection\":[\"AI Security\",\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-13T14:25:55+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts\",\"name\":\"CVE-2026-123493: Vikunja Bot Token Bypass Vulnerability\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts-title.webp\",\"datePublished\":\"2026-11-13T14:25:55+00:00\",\"description\":\"CVE-2026-123493 in Vikunja 2.4.0\u20132.7.0 lets disabled users keep access via bot API tokens. Admins must revoke bot tokens manually. Patch in 2.7.1.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Image: AI-generated, i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2026-123493: Vikunja bot tokens bypass account lockouts, let disabled users keep access\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"},\"subjectOf\":[{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/papers.ssrn.com\\\/abstract=7426699\",\"name\":\"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/www.heise.de\\\/news\\\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html\",\"name\":\"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/t3n.de\\\/news\\\/bewerbung-schreiben-ki-5-fehler-1747190\\\/\",\"name\":\"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden\"}]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2026-123493: Vikunja Bot Token Bypass Vulnerability","description":"CVE-2026-123493 in Vikunja 2.4.0\u20132.7.0 lets disabled users keep access via bot API tokens. Admins must revoke bot tokens manually. Patch in 2.7.1.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts","og_locale":"en_US","og_type":"article","og_title":"CVE-2026-123493: Vikunja Bot Token Bypass Vulnerability","og_description":"CVE-2026-123493 in Vikunja 2.4.0\u20132.7.0 lets disabled users keep access via bot API tokens. Admins must revoke bot tokens manually. Patch in 2.7.1.","og_url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts","og_site_name":"i10X News","article_published_time":"2026-11-13T14:25:55+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_image":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"CVE-2026-123493: Vikunja bot tokens bypass account lockouts, let disabled users keep access","datePublished":"2026-11-13T14:25:55+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts"},"wordCount":593,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts-title.webp","articleSection":["AI Security","Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-11-13T14:25:55+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts","url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts","name":"CVE-2026-123493: Vikunja Bot Token Bypass Vulnerability","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts-title.webp","datePublished":"2026-11-13T14:25:55+00:00","description":"CVE-2026-123493 in Vikunja 2.4.0\u20132.7.0 lets disabled users keep access via bot API tokens. Admins must revoke bot tokens manually. Patch in 2.7.1.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts-title.webp","width":1344,"height":768,"caption":"Image: AI-generated, i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123493-vikunja-bot-tokens-bypass-account-lockouts#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"CVE-2026-123493: Vikunja bot tokens bypass account lockouts, let disabled users keep access"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"},"subjectOf":[{"@type":"CreativeWork","url":"https:\/\/papers.ssrn.com\/abstract=7426699","name":"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens"},{"@type":"CreativeWork","url":"https:\/\/www.heise.de\/news\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html","name":"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT"},{"@type":"CreativeWork","url":"https:\/\/t3n.de\/news\/bewerbung-schreiben-ki-5-fehler-1747190\/","name":"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden"}]}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8881","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=8881"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8881\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/8880"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=8881"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=8881"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=8881"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=8881"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=8881"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}