CVE-2026-123527

EUVD-2026-119412
Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delete them via the v2 DELETE background route, and bucket create-only tokens can update existing buckets.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 14.87%
Common Weakness Enumeration
References
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-j5v7-qcwp-5g32
https://www.vulncheck.com/advisories/vikunja-2.4.0-before-2.7.1-api-token-scope-collision-authorization-bypass