A critical authorization flaw in Vikunja prior to version 2.2.0 allows disabled users to bypass account status restrictions and regain unauthorized access to the platform.

The vulnerability exists in the ResetPassword function, which fails to verify the prior account status before resetting a user's status to active. This allows an authenticated, albeit disabled, user to request a password reset token and regain full access to the application.

The ability for disabled users to regain access to their accounts poses a significant risk to organizational security policies. This bypasses administrative controls intended to restrict access for terminated or suspended personnel, potentially leading to unauthorized data exposure or malicious activity within the task management environment. Given the CVSS score of 8.1, this is classified as a high-severity issue that requires immediate attention to prevent unauthorized access.

Immediate Action: Update the Vikunja instance to version 2.2.0 or later to ensure the password reset logic correctly validates account status.

Proactive Monitoring: Review application access logs for unexpected password reset requests or activity from accounts previously marked as disabled.

Compensating Controls: If an immediate update is not feasible, consider restricting access to the API endpoints at /api/v1/user/password/token and /api/v1/user/password/reset via a Web Application Firewall (WAF) until the patch can be applied.

Public Exploit Available: No (no confirmed public exploit exists in the provided data).

This vulnerability represents a significant breakdown in authorization controls within the Vikunja platform. Administrators must prioritize updating to version 2.2.0 immediately to restore the integrity of account management processes and prevent unauthorized access by disabled users. Failure to address this flaw could lead to the circumvention of critical administrative access policies.