Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background, while a token with only projects.background_delete is rejected. This is a scoped-token authorization bypass. This vulnerability is fixed in 2.3.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-v479-vf79-mg83 | Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 10 Apr 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background, while a token with only projects.background_delete is rejected. This is a scoped-token authorization bypass. This vulnerability is fixed in 2.3.0. | |
| Title | Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds | |
| Weaknesses | CWE-836 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-04-10T16:12:27.603Z
Reserved: 2026-04-09T01:41:38.536Z
Link: CVE-2026-40103
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-10T17:17:13.143
Modified: 2026-04-10T17:17:13.143
Link: CVE-2026-40103
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses