CVE-2026-91973

Vikunja, an open-source self-hosted to-do/task management application, fails to apply rate limiting to its CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) in all versions before 2.6.0. A remote unauthenticated attacker can send an unbounded number of credential-guessing requests against these routes, bypassing the instance's normal anti-brute-force protections and eventually compromising accounts that rely on password-only authentication. The flaw is classified as CWE-307 (improper limitation of excessive authentication attempts) and carries a high CVSS 4.0 score of 8.7 due to its network vector, low attack complexity, and high confidentiality impact. Any self-hosted or managed Vikunja instance running a version earlier than 2.6.0 with these endpoints reachable is affected, especially where users have weak or reused passwords. There is no known public proof-of-concept, the CVE is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported to date.

What to do: Upgrade every Vikunja instance to version 2.6.0 or later, where rate limiting is applied to the CalDAV BasicAuth routes. As defense in depth, place reverse-proxy rate limits or network access controls on /dav, /.well-known, and /feeds, and move users off password-only authentication (enable 2FA or OIDC where feasible). Review authentication logs on pre-2.6.0 instances for high volumes of failed BasicAuth attempts against those routes and force password resets on any targeted accounts.