https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T08:10:03.219886+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-291417 EUVD-2026-291417 2026-10-06T08:10:03.253383+00:00 EUVD-2026-291417 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40103 fkie_cve-2026-40103 2026-10-06T08:10:03.253420+00:00

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background, while a token with only projects.background_delete is rejected. This is a scoped-token authorization bypass. This vulnerability is fixed in 2.3.0.

 https://cve.radiocsirt.org/vuln/ghsa-v479-vf79-mg83 GHSA-v479-vf79-mg83 — Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds 2026-10-06T08:10:03.253479+00:00

Affected: Go: code.vikunja.io/api

### Summary

Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only `projects.background` can successfully delete a project background, while a token with only `projects.background_delete` is rejected.

This is a scoped-token authorization bypass.

### Details

I verified this locally on commit `c5450fb55f5192508638cbb3a6956438452a712e`.

Relevant code paths: * `pkg/models/api_routes.go` * `pkg/routes/routes.go` * `pkg/modules/background/handler/background.go`

Route registration exposes separate permissions for the same path: * `GET /api/v1/projects/:project/background` -> `projects.background` * `DELETE /api/v1/projects/:project/background` -> `projects.background_delete`

At enforcement time, `CanDoAPIRoute()` falls back to the parent group and reconstructs the child permission from the path segments only. For the DELETE request, that becomes `background`, so the matcher accepts any token containing `projects.background` without re-checking the HTTP method or matching the stored route detail.

This matters because `RemoveProjectBackground()` is a real destructive operation: * It checks project update rights. * It deletes the background file if present. * It clears the project's `BackgroundFileID`.

### PoC

1. Log in as a user who can update a project that already has a background. 2. Create an API token with only: `{"projects":["background"]}` 3. Send: `DELETE /api/v1/projects/<project_id>/background` `A…