CVE-2026-40103
Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds
MEDIUM 5.4EPSS 0.3%
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background, while a token with only projects.background_delete is rejected. This is a scoped-token authorization bypass. This vulnerability is fixed in 2.3.0.
- Affected
- go-vikunja · vikunja
- CVSS v3.1 NVD
- 5.4 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - CVSS v3.1 GITHUB
- 4.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - EPSS
- 0.35% chance of exploitation in the next 30 days, 27th percentile
- Published
- 2026-04-10
- Updated
- 2026-04-15