Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-28268 is a critical-severity Incomplete Cleanup (CWE-459) vulnerability in Vikunja Vikunja. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 49th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-12 (Identity Proofing) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-28268 is a business logic vulnerability in the password reset mechanism of Vikunja, an open-source self-hosted task management platform. Specifically, it affects the vikunja/api component in versions prior to 2.1.0. The flaw stems from a failure to invalidate password reset tokens upon use, combined with a critical logic bug in the token cleanup cron job, which causes tokens to remain valid indefinitely. This issue is rated with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-459 (Incomplete Cleanup) and CWE-640 (Weak Password Recovery Mechanism for Forgotten Password).
The vulnerability can be exploited by any remote attacker with no privileges who obtains a single password reset token, such as through interception via server logs, browser history, or phishing attacks. Once in possession of the token, the attacker can reuse it indefinitely to reset the victim's password, achieving complete and persistent account takeover at any future time and bypassing standard authentication controls.
Vikunja version 2.1.0 addresses the issue with a patch, as detailed in the project's GitHub commit (5c2195f9fca9ad208477e865e6009c37889f87b2), security advisory (GHSA-rfjg-6m84-crj2), and changelog for v2.1.0. Security practitioners should upgrade to version 2.1.0 or later and review logs for evidence of token interception.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9064
Vulnerability Data
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate…
more
tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever. This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls. Version 2.1.0 contains a patch for the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.4.1V7.4.3
Mitigating Controls (NIST 800-53 r5) AI
Identity proofing at appropriate assurance levels ensures forgotten-password recovery cannot succeed without strong verification of the user.
Authenticator management requires secure distribution, reset, and verification procedures that directly address weak password recovery flows.
Developer testing and evaluation can discover incomplete cleanup through dynamic analysis or resource-leak testing.
Non-persistence mechanisms explicitly initiate resources in a known state and terminate them, directly enforcing cleanup.
Session termination forces explicit release of session-related temporary resources.
Preventing unintended information transfer through shared resources requires complete cleanup of those resources.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Credential lifecycle management directly includes password reset/recovery flows.
Identity proofing is the core control that prevents weak or bypassed recovery mechanisms.
Secure-development practices and coding standards normally require proper resource release and cleanup.
Life-cycle management encompasses disposal of temporary resources but does not specifically target runtime cleanup bugs.
Authentication policy covers strength/MFA but does not address recovery path weaknesses.
Explicitly calls for removing sensitive data after use, directly addressing one class of incomplete cleanup.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Explicitly requires secure deletion of temporary or residual data, directly addressing incomplete cleanup.
Strong authentication-information lifecycle rules directly address weak password-recovery flows.
SDLC practices include cleanup steps, yet the weakness can still occur if those steps are omitted.
Application-security requirements can mandate secure recovery flows, but the control covers many other requirements.
Secure-coding rules can mandate explicit cleanup of temporary resources, but do not guarantee it.
Change-management processes may require cleanup verification, but the control itself does not address the weakness.