Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-521** (Weak Password Requirements). The system fails to enforce strong passwords and doesn't invalidate active sessions upon credential update.

Q: Who is affected? (Versions/Components)

📦 **Affected**: **Vikunja** (go-vikunja/vikunja). Specifically versions **prior to 2.0.0**. 📅 Published: 2026-02-25.

Q: What can hackers do? (Privileges/Data)

🕵️ **Attacker Actions**: Hijack user accounts. Gain **Full Access** (Confidentiality & Integrity impact). Maintain access even if the user changes their password. 📈 CVSS: High (H/H/N).

Q: Is exploitation threshold high? (Auth/Config)

🔓 **Threshold**: **LOW**. CVSS: AV:N (Network), AC:L (Low Complexity), PR:N (No Privs needed), UI:N (No User Interaction). Easy to exploit remotely.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🧪 **Exploit Status**: **No public PoC** listed in data. However, the flaw is logical and straightforward, making wild exploitation likely if details leak.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for Vikunja instances running versions **< 2.0.0**. Check if weak passwords are accepted. Verify if sessions persist after password resets.

Q: What if no patch? (Workaround)

🚧 **No Patch Workaround**: Enforce strong password policies manually. **Force logout** all active sessions immediately after any password change. Monitor for suspicious activity.

Q: Is it urgent? (Priority Suggestion)

⚡ **Urgency**: **HIGH**. CVSS Vector indicates High Impact. No auth required. Immediate upgrade to v2.0.0 is critical to prevent account takeover.

Question 1

What is this vulnerability? (Essence + Consequences)

Accepted Answer

🚨 **Essence**: Vikunja < v2.0.0 allows weak passwords & keeps old sessions alive after password change. 💥 **Consequences**: Account hijacking & persistent unauthorized access.

Question 2

Root Cause? (CWE/Flaw)

Accepted Answer

🛡️ **Root Cause**: **CWE-521** (Weak Password Requirements). The system fails to enforce strong passwords and doesn't invalidate active sessions upon credential update.

Question 3

Who is affected? (Versions/Components)

Accepted Answer

📦 **Affected**: **Vikunja** (go-vikunja/vikunja). Specifically versions **prior to 2.0.0**. 📅 Published: 2026-02-25.

Question 4

What can hackers do? (Privileges/Data)

Accepted Answer

🕵️ **Attacker Actions**: Hijack user accounts. Gain **Full Access** (Confidentiality & Integrity impact). Maintain access even if the user changes their password. 📈 CVSS: High (H/H/N).

Question 5

Is exploitation threshold high? (Auth/Config)

Accepted Answer

🔓 **Threshold**: **LOW**. CVSS: AV:N (Network), AC:L (Low Complexity), PR:N (No Privs needed), UI:N (No User Interaction). Easy to exploit remotely.

Question 6

Is there a public Exp? (PoC/Wild Exploitation)

Accepted Answer

🧪 **Exploit Status**: **No public PoC** listed in data. However, the flaw is logical and straightforward, making wild exploitation likely if details leak.

Question 7

How to self-check? (Features/Scanning)

Accepted Answer

🔍 **Self-Check**: Scan for Vikunja instances running versions **< 2.0.0**. Check if weak passwords are accepted. Verify if sessions persist after password resets.

Question 8

Is it fixed officially? (Patch/Mitigation)

Accepted Answer

✅ **Fix**: **Yes**. Official patch released in **Vikunja v2.0.0**.…

Question 9

What if no patch? (Workaround)

Accepted Answer

🚧 **No Patch Workaround**: Enforce strong password policies manually. **Force logout** all active sessions immediately after any password change. Monitor for suspicious activity.

Question 10

Is it urgent? (Priority Suggestion)

Accepted Answer

⚡ **Urgency**: **HIGH**. CVSS Vector indicates High Impact. No auth required. Immediate upgrade to v2.0.0 is critical to prevent account takeover.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-27575 — AI Deep Analysis Summary

Q1What is this vulnerability? (Essence + Consequences)

Q2Root Cause? (CWE/Flaw)

Q3Who is affected? (Versions/Components)

Q4What can hackers do? (Privileges/Data)

Q5Is exploitation threshold high? (Auth/Config)

Q6Is there a public Exp? (PoC/Wild Exploitation)

Q7How to self-check? (Features/Scanning)

Q8Is it fixed officially? (Patch/Mitigation)

Q9What if no patch? (Workaround)

Q10Is it urgent? (Priority Suggestion)

Continue exploring