Authorization Bypass Vulnerability in Vikunja by Vikunja
CVE-2026-123527

5.3MEDIUM

Key Information:

Vendor

Go-vikunja

Status
Vikunja
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123527?

Vikunja versions 2.4.0 through 2.7.1 are susceptible to an authorization bypass vulnerability stemming from conflicting API token permission keys for v1 and v2. This flaw allows attackers holding certain tokens to execute unauthorized actions, such as deleting project backgrounds when they should only have read access. Additionally, tokens intended for creating buckets are able to modify existing ones, raising significant security concerns for users relying on these permissions. Proper mitigation steps are essential to address this vulnerability and safeguard user data.

Affected Version(s)

vikunja 2.4.0 < 2.7.1

vikunja 2.7.1

References

https://github.com/go-vikunja/vikunja/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/vikunja-2.4.0-before...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dylanzonix
.