https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-10T21:03:23.429554+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-123530 CVE-2026-123530 — Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints 2026-11-10T21:03:23.430892+00:00

Affected: go-vikunja vikunja

Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to enroll and enable TOTP without the account password. Attackers can call the TOTP enroll and enable endpoints with their own secret to lock the owner out, persisting even after password reset.