EUVD-2026-291417

fkie_cve-2026-40103

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background, while a token with only projects.background_delete is rejected. This is a scoped-token authorization bypass. This vulnerability is fixed in 2.3.0.

GHSA-v479-vf79-mg83 — Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds

Affected: Go: code.vikunja.io/api

### Summary

Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only `projects.background` can successfully delete a project background, while a token with only `projects.background_delete` is rejected.

This is a scoped-token authorization bypass.

### Details

I verified this locally on commit `c5450fb55f5192508638cbb3a6956438452a712e`.

Relevant code paths: * `pkg/models/api_routes.go` * `pkg/routes/routes.go` * `pkg/modules/background/handler/background.go`

Route registration exposes separate permissions for the same path: * `GET /api/v1/projects/:project/background` -> `projects.background` * `DELETE /api/v1/projects/:project/background` -> `projects.background_delete`

At enforcement time, `CanDoAPIRoute()` falls back to the parent group and reconstructs the child permission from the path segments only. For the DELETE request, that becomes `background`, so the matcher accepts any token containing `projects.background` without re-checking the HTTP method or matching the stored route detail.

This matters because `RemoveProjectBackground()` is a real destructive operation: * It checks project update rights. * It deletes the background file if present. * It clears the project's `BackgroundFileID`.

### PoC

1. Log in as a user who can update a project that already has a background. 2. Create an API token with only: `{"projects":["background"]}` 3. Send: `DELETE /api/v1/projects/<project_id>/background` `A…

Most recent entries from all

EUVD-2026-291417

fkie_cve-2026-40103

GHSA-v479-vf79-mg83 — Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds