Scoped API Token Bypass in Vikunja Task Management Platform

CVE-2026-40103

What is CVE-2026-40103?

Vikunja, a self-hosted task management platform, has a vulnerability in its API token enforcement mechanism affecting versions before 2.3.0. This vulnerability allows an attacker to leverage a scoped API token with permissions for 'projects.background' to delete project backgrounds, even though they should lack the necessary permissions associated with 'projects.background_delete'. The issue has been addressed in version 2.3.0, which strengthens the authentication checks. Users are encouraged to update to the latest version to mitigate this security risk.

References