{"id":"EUVD-2026-21494","enisaUuid":"7d5a407e-da30-3e31-97d8-319402695840","description":"Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja\u0027s scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background, while a token with only projects.background_delete is rejected. This is a scoped-token authorization bypass. This vulnerability is fixed in 2.3.0.","datePublished":"Apr 10, 2026, 4:12:27 PM","dateUpdated":"Apr 15, 2026, 2:45:18 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v479-vf79-mg83\nhttps://github.com/go-vikunja/vikunja/pull/2584\nhttps://github.com/go-vikunja/vikunja/commit/6a0f39b252a81fa4b19dc56dc889183acc9225ae\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.3.0\n","aliases":"CVE-2026-40103\nGHSA-v479-vf79-mg83\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"aa6b001a-c553-3e2e-8a5c-114b298be244","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"\u003c 2.3.0"}],"enisaIdVendor":[{"id":"cb2db7d0-63dd-3a3e-a4c8-12d7b4bd832b","vendor":{"name":"go-vikunja"}}],"enisaIdVulnerability":[{"id":"5ce72c5d-f011-3aa8-9072-eaab8f11c89f","vulnerability":{"id":"CVE-2026-40103","description":"Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja\u0027s scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background, while a token with only projects.background_delete is rejected. This is a scoped-token authorization bypass. This vulnerability is fixed in 2.3.0.","datePublished":"Apr 10, 2026, 4:12:27 PM","dateUpdated":"Apr 15, 2026, 2:45:18 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v479-vf79-mg83\nhttps://github.com/go-vikunja/vikunja/pull/2584\nhttps://github.com/go-vikunja/vikunja/commit/6a0f39b252a81fa4b19dc56dc889183acc9225ae\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.3.0\n","enisa_id":"EUVD-2026-21494\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Oct 27, 2026, 7:16:42 AM","vulnerabilityProduct":[{"id":"46066a1c-6954-3c03-956a-67a9a511c651","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"\u003c 2.3.0"}],"vulnerabilityVendor":[{"id":"64a237f3-3292-3e91-8a70-b35fe167b315","vendor":{"name":"go-vikunja"}}]}},{"id":"6065e856-3e16-3464-8a46-95da9c5b056f","vulnerability":{"id":"GHSA-v479-vf79-mg83","description":"Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds","datePublished":"Apr 10, 2026, 3:36:47 PM","dateUpdated":"Apr 24, 2026, 8:49:21 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v479-vf79-mg83\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40103\nhttps://github.com/go-vikunja/vikunja/pull/2584\nhttps://github.com/go-vikunja/vikunja/commit/6a0f39b252a81fa4b19dc56dc889183acc9225ae\nhttps://github.com/go-vikunja/vikunja\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.3.0\n","enisa_id":"EUVD-2026-21494\n","aliases":"CVE-2026-40103\nGHSA-v479-vf79-mg83\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}