CWE-459
AllowedIncomplete Cleanup
Abstraction: Base · Status: Draft
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
254 vulnerabilities reference this CWE, most recent first.
GHSA-Q8C5-864C-FVVV
Vulnerability from github – Published: 2024-03-12 09:30 – Updated: 2024-03-12 09:30An unauthenticated remote attacker can gain service level privileges through an incomplete cleanup during service restart after a DoS.
{
"affected": [],
"aliases": [
"CVE-2024-26005"
],
"database_specific": {
"cwe_ids": [
"CWE-459"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-12T09:15:09Z",
"severity": "MODERATE"
},
"details": "An unauthenticated remote attacker\u00a0can gain service level privileges through an incomplete cleanup during service restart after a DoS.\u00a0",
"id": "GHSA-q8c5-864c-fvvv",
"modified": "2024-03-12T09:30:42Z",
"published": "2024-03-12T09:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26005"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2024-011"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q9QJ-GQMF-73C2
Vulnerability from github – Published: 2022-06-16 00:00 – Updated: 2025-05-05 18:32Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
{
"affected": [],
"aliases": [
"CVE-2022-21127"
],
"database_specific": {
"cwe_ids": [
"CWE-459"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-15T20:15:00Z",
"severity": "MODERATE"
},
"details": "Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.",
"id": "GHSA-q9qj-gqmf-73c2",
"modified": "2025-05-05T18:32:07Z",
"published": "2022-06-16T00:00:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21127"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220624-0008"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5178"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00615.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/06/16/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QG7X-R68H-9889
Vulnerability from github – Published: 2022-05-13 01:17 – Updated: 2022-05-13 01:17A vulnerability in the installation process of Cisco HyperFlex Software could allow an authenticated, local attacker to read sensitive information. The vulnerability is due to insufficient cleanup of installation files. An attacker could exploit this vulnerability by accessing the residual installation files on an affected system. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system.
{
"affected": [],
"aliases": [
"CVE-2018-15407"
],
"database_specific": {
"cwe_ids": [
"CWE-459"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-10-05T14:29:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the installation process of Cisco HyperFlex Software could allow an authenticated, local attacker to read sensitive information. The vulnerability is due to insufficient cleanup of installation files. An attacker could exploit this vulnerability by accessing the residual installation files on an affected system. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system.",
"id": "GHSA-qg7x-r68h-9889",
"modified": "2022-05-13T01:17:45Z",
"published": "2022-05-13T01:17:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15407"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-hyperflex-info"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QJWP-794R-6X7V
Vulnerability from github – Published: 2024-10-15 12:30 – Updated: 2025-11-04 00:31In the Linux kernel, the following vulnerability has been resolved:
mm: avoid leaving partial pfn mappings around in error case
As Jann points out, PFN mappings are special, because unlike normal memory mappings, there is no lifetime information associated with the mapping - it is just a raw mapping of PFNs with no reference counting of a 'struct page'.
That's all very much intentional, but it does mean that it's easy to mess up the cleanup in case of errors. Yes, a failed mmap() will always eventually clean up any partial mappings, but without any explicit lifetime in the page table mapping itself, it's very easy to do the error handling in the wrong order.
In particular, it's easy to mistakenly free the physical backing store before the page tables are actually cleaned up and (temporarily) have stale dangling PTE entries.
To make this situation less error-prone, just make sure that any partial pfn mapping is torn down early, before any other error handling.
{
"affected": [],
"aliases": [
"CVE-2024-47674"
],
"database_specific": {
"cwe_ids": [
"CWE-459"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-15T11:15:13Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: avoid leaving partial pfn mappings around in error case\n\nAs Jann points out, PFN mappings are special, because unlike normal\nmemory mappings, there is no lifetime information associated with the\nmapping - it is just a raw mapping of PFNs with no reference counting of\na \u0027struct page\u0027.\n\nThat\u0027s all very much intentional, but it does mean that it\u0027s easy to\nmess up the cleanup in case of errors. Yes, a failed mmap() will always\neventually clean up any partial mappings, but without any explicit\nlifetime in the page table mapping itself, it\u0027s very easy to do the\nerror handling in the wrong order.\n\nIn particular, it\u0027s easy to mistakenly free the physical backing store\nbefore the page tables are actually cleaned up and (temporarily) have\nstale dangling PTE entries.\n\nTo make this situation less error-prone, just make sure that any partial\npfn mapping is torn down early, before any other error handling.",
"id": "GHSA-qjwp-794r-6x7v",
"modified": "2025-11-04T00:31:34Z",
"published": "2024-10-15T12:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47674"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3213fdcab961026203dd587a4533600c70b3336b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/35770ca6180caa24a2b258c99a87bd437a1ee10f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5b2c8b34f6d76bfbd1dd4936eb8a0fbfb9af3959"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/65d0db500d7c07f0f76fc24a4d837791c4862cd2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/79a61cc3fc0466ad2b7b89618a6157785f0293b3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/954fd4c81f22c4b6ba65379a81fd252971bf4ef3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a95a24fcaee1b892e47d5e6dcc403f713874ee80"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
},
{
"type": "WEB",
"url": "https://project-zero.issues.chromium.org/issues/366053091"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QP87-27Q4-8526
Vulnerability from github – Published: 2024-03-13 18:31 – Updated: 2025-03-26 21:30Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Windows allows an attacker that compromised a user endpoint, under specific circumstances, to access sensitive information via residual files in the temporary directory.
{
"affected": [],
"aliases": [
"CVE-2024-2403"
],
"database_specific": {
"cwe_ids": [
"CWE-459"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-13T18:15:07Z",
"severity": "MODERATE"
},
"details": "Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and\nearlier on Windows allows an attacker that compromised a user endpoint, under specific circumstances, to access sensitive information via residual files in the temporary directory.",
"id": "GHSA-qp87-27q4-8526",
"modified": "2025-03-26T21:30:56Z",
"published": "2024-03-13T18:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2403"
},
{
"type": "WEB",
"url": "https://devolutions.net/security/advisories/DEVO-2024-0004"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QWXP-946X-P86V
Vulnerability from github – Published: 2022-05-13 01:50 – Updated: 2022-05-13 01:50An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.
{
"affected": [],
"aliases": [
"CVE-2018-19961"
],
"database_specific": {
"cwe_ids": [
"CWE-459"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-12-08T04:29:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.",
"id": "GHSA-qwxp-946x-p86v",
"modified": "2022-05-13T01:50:54Z",
"published": "2022-05-13T01:50:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19961"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT"
},
{
"type": "WEB",
"url": "https://support.citrix.com/article/CTX239432"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2019/dsa-4369"
},
{
"type": "WEB",
"url": "https://xenbits.xen.org/xsa/advisory-275.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106182"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R9HW-MJ3W-PHCQ
Vulnerability from github – Published: 2026-07-06 21:54 – Updated: 2026-07-06 21:54uutils calls mknod before setting the SELinux context (GNU uses setfscreatecon first, labeling atomically). If set_selinux_security_context fails, cleanup uses std::fs::remove_dir, which cannot remove device nodes or FIFOs, leaving the mislabeled node behind.
Impact: on SELinux-enforcing systems the node is created with the wrong context; the command reports failure but leaves a mislabeled device node that may bypass mandatory access control, and orphaned nodes can persist across reboots. Recommendation: use setfscreatecon before mknod, abort on failure, and use remove_file for cleanup.
Remediation: Acknowledged by Canonical.
Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.58. Credit: Zellic.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "uu_mknod"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35361"
],
"database_specific": {
"cwe_ids": [
"CWE-281",
"CWE-459",
"CWE-732"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-06T21:54:05Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "uutils calls `mknod` *before* setting the SELinux context (GNU uses `setfscreatecon` first, labeling atomically). If `set_selinux_security_context` fails, cleanup uses `std::fs::remove_dir`, which cannot remove device nodes or FIFOs, leaving the mislabeled node behind.\n\n**Impact:** on SELinux-enforcing systems the node is created with the wrong context; the command reports failure but leaves a mislabeled device node that may bypass mandatory access control, and orphaned nodes can persist across reboots. Recommendation: use `setfscreatecon` before `mknod`, abort on failure, and use `remove_file` for cleanup.\n\n**Remediation:** Acknowledged by Canonical.\n\n---\n_Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.58. Credit: Zellic._",
"id": "GHSA-r9hw-mj3w-phcq",
"modified": "2026-07-06T21:54:05Z",
"published": "2026-07-06T21:54:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/security/advisories/GHSA-r9hw-mj3w-phcq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35361"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/pull/10582"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/commit/42b2ad83cdcf6e959ecb378c5040c60d9c64becf"
},
{
"type": "PACKAGE",
"url": "https://github.com/uutils/coreutils"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/releases/tag/0.6.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "mknod: Device nodes created mislabeled on SELinux, with broken cleanup (remove_dir on a node)"
}
GHSA-R9VW-PX66-GX7G
Vulnerability from github – Published: 2022-05-01 02:01 – Updated: 2024-02-08 21:30BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to continue to access the application without having to log in again, which may be in violation of newly changed security constraints or role mappings.
{
"affected": [],
"aliases": [
"CVE-2005-1744"
],
"database_specific": {
"cwe_ids": [
"CWE-459"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2005-05-24T04:00:00Z",
"severity": "HIGH"
},
"details": "BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to continue to access the application without having to log in again, which may be in violation of newly changed security constraints or role mappings.",
"id": "GHSA-r9vw-px66-gx7g",
"modified": "2024-02-08T21:30:31Z",
"published": "2022-05-01T02:01:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-1744"
},
{
"type": "WEB",
"url": "http://dev2dev.bea.com/pub/advisory/127"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/15486"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1014049"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2005/0604"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RCGX-6RCQ-V2MX
Vulnerability from github – Published: 2022-04-16 00:00 – Updated: 2022-04-26 00:00Under certain circumstances the session token is not cleared on logout.
{
"affected": [],
"aliases": [
"CVE-2021-36205"
],
"database_specific": {
"cwe_ids": [
"CWE-459"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-15T17:15:00Z",
"severity": "CRITICAL"
},
"details": "Under certain circumstances the session token is not cleared on logout.",
"id": "GHSA-rcgx-6rcq-v2mx",
"modified": "2022-04-26T00:00:58Z",
"published": "2022-04-16T00:00:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36205"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-104-02"
},
{
"type": "WEB",
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RFJG-6M84-CRJ2
Vulnerability from github – Published: 2026-02-28 01:59 – Updated: 2026-02-28 01:59Summary A critical business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever.
This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls.
Technical Analysis The vulnerability stems from two distinct logic errors in the pkg/user/ package that confirm the tokens are never removed.
- Logic Error in Password Reset (No Invalidation) In pkg/user/user_password_reset.go, the ResetPassword function successfully updates the user's password but fails to delete the reset token used to authorize the request. Instead, it attempts to delete a TokenEmailConfirm token, leaving the TokenPasswordReset active.
Vulnerable Code: pkg/user/user_password_reset.go (Lines 36-94)
func ResetPassword(s *xorm.Session, reset *PasswordReset) (userID int64, err error) {
// ... [Validation and User Lookup] ...
// Hash the password
user.Password, err = HashPassword(reset.NewPassword)
if err != nil {
return
}
// FLAW: Deletes 'TokenEmailConfirm' instead of the current 'TokenPasswordReset'
err = removeTokens(s, user, TokenEmailConfirm)
if err != nil {
return
}
// ... [Update User Status and Return] ...
// The reset token is never removed and remains valid in the DB.
}
- Logic Error in Token Cleanup (Inverted Expiry) The background cron job intended to expire old tokens contains an inverted comparison operator. It deletes tokens newer than 24 hours instead of older ones.
Vulnerable Code: pkg/user/token.go (Lines 125-151)
func RegisterTokenCleanupCron() {
// ...
err := cron.Schedule("0 * * * *", func() {
// ...
// FLAW: "created > ?" selects tokens created AFTER 24 hours ago.
// This deletes NEW valid tokens and keeps OLD expired tokens forever.
deleted, err := s.
Where("created > ? AND (kind = ? OR kind = ?)",
time.Now().Add(time.Hour*24*-1),
TokenPasswordReset, TokenAccountDeletion).
Delete(&Token{})
// ...
})
}
Impact Persistent Account Takeover: An attacker with a single valid token can reset the victim's password an unlimited number of times.
Bypass of Remediation: Even if the victim notices suspicious activity and changes their password, the attacker can use the same old token to reset it again immediately.
Infinite Attack Window: Because the cleanup cron is broken, the token effectively has a generic TTL of "forever," allowing exploitation months or years after the token was issued.
Remediation
1. Invalidate Token on Use
Update ResetPassword to delete the specific reset token upon successful completion.
// Recommended Fix
err = removeTokens(s, user, TokenPasswordReset) // Correct TokenKind
2. Fix Cleanup Logic
Update the SQL query in RegisterTokenCleanupCron to target tokens created before the cutoff time.
// Recommended Fix
Where("created < ? ...", time.Now().Add(time.Hour*24*-1), ...) // Use Less Than (<)
A fix is available at https://github.com/go-vikunja/vikunja/releases/tag/v2.1.0
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "code.vikunja.io/api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.24.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-28268"
],
"database_specific": {
"cwe_ids": [
"CWE-459",
"CWE-640"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-28T01:59:28Z",
"nvd_published_at": "2026-02-27T21:16:18Z",
"severity": "CRITICAL"
},
"details": "**Summary**\nA critical business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever.\n\nThis allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls.\n\n**Technical Analysis**\nThe vulnerability stems from two distinct logic errors in the pkg/user/ package that confirm the tokens are never removed.\n\n1. Logic Error in Password Reset (No Invalidation)\nIn pkg/user/user_password_reset.go, the ResetPassword function successfully updates the user\u0027s password but fails to delete the reset token used to authorize the request. Instead, it attempts to delete a TokenEmailConfirm token, leaving the TokenPasswordReset active.\n\nVulnerable Code: pkg/user/user_password_reset.go (Lines 36-94)\n```\nfunc ResetPassword(s *xorm.Session, reset *PasswordReset) (userID int64, err error) {\n // ... [Validation and User Lookup] ...\n\n // Hash the password\n user.Password, err = HashPassword(reset.NewPassword)\n if err != nil {\n return\n }\n\n // FLAW: Deletes \u0027TokenEmailConfirm\u0027 instead of the current \u0027TokenPasswordReset\u0027\n err = removeTokens(s, user, TokenEmailConfirm)\n if err != nil {\n return\n }\n\n // ... [Update User Status and Return] ...\n // The reset token is never removed and remains valid in the DB.\n}\n```\n2. Logic Error in Token Cleanup (Inverted Expiry)\nThe background cron job intended to expire old tokens contains an inverted comparison operator. It deletes tokens newer than 24 hours instead of older ones.\n\nVulnerable Code: pkg/user/token.go (Lines 125-151)\n```\nfunc RegisterTokenCleanupCron() {\n // ...\n err := cron.Schedule(\"0 * * * *\", func() {\n // ...\n // FLAW: \"created \u003e ?\" selects tokens created AFTER 24 hours ago.\n // This deletes NEW valid tokens and keeps OLD expired tokens forever.\n deleted, err := s.\n Where(\"created \u003e ? AND (kind = ? OR kind = ?)\", \n time.Now().Add(time.Hour*24*-1), \n TokenPasswordReset, TokenAccountDeletion).\n Delete(\u0026Token{})\n // ...\n })\n}\n\n```\n\n**Impact**\nPersistent Account Takeover: An attacker with a single valid token can reset the victim\u0027s password an unlimited number of times.\n\nBypass of Remediation: Even if the victim notices suspicious activity and changes their password, the attacker can use the same old token to reset it again immediately.\n\nInfinite Attack Window: Because the cleanup cron is broken, the token effectively has a generic TTL of \"forever,\" allowing exploitation months or years after the token was issued.\n\n**Remediation**\n1. Invalidate Token on Use\nUpdate ResetPassword to delete the specific reset token upon successful completion.\n`// Recommended Fix\nerr = removeTokens(s, user, TokenPasswordReset) // Correct TokenKind`\n2. Fix Cleanup Logic\nUpdate the SQL query in RegisterTokenCleanupCron to target tokens created before the cutoff time.\n`// Recommended Fix\nWhere(\"created \u003c ? ...\", time.Now().Add(time.Hour*24*-1), ...) // Use Less Than (\u003c)`\n\nA fix is available at https://github.com/go-vikunja/vikunja/releases/tag/v2.1.0",
"id": "GHSA-rfjg-6m84-crj2",
"modified": "2026-02-28T01:59:28Z",
"published": "2026-02-28T01:59:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rfjg-6m84-crj2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28268"
},
{
"type": "WEB",
"url": "https://github.com/go-vikunja/vikunja/commit/5c2195f9fca9ad208477e865e6009c37889f87b2"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-vikunja/vikunja"
},
{
"type": "WEB",
"url": "https://vikunja.io/changelog/vikunja-v2.1.0-was-released"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse"
}
Mitigation
Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
No CAPEC attack patterns related to this CWE.