{"id":"CVE-2026-123527","kind":"vulnerability","aliases":["CVE-2026-123527"],"related":[],"title":"Vikunja: colliding API token permissions let scoped tokens delete or edit data","description":"Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delete them via the v2 DELETE background route, and bucket create-only tokens can update existing buckets.","summary":"Vikunja versions from 2.4.0 before 2.7.1 mix up v1 and v2 API token permission keys, so a token scoped for one action can perform others. An attacker holding a read-only background token can delete project backgrounds, and a bucket create-only token can update existing buckets.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-tokens","package","self-hosted","vikunja"],"not_affected_if":["no-api-tokens","version-2.7.1-or-later"],"how_to_check":"- Check the Vikunja version in use; affected versions are `2.4.0` up to but not including `2.7.1`\n- Review API tokens issued to users and automations for scopes such as project backgrounds or bucket creation","fix":"- Vikunja: move to `2.7.1` or later","status":"open","published_at":"2026-11-08T02:16:42+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","triaged_at":"2026-11-08T02:25:12+00:00","updated_at":"2026-11-08T02:25:12+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:25:12Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: move to `2.7.1` or later","reach":"network","title":"Vikunja: colliding API token permissions let scoped tokens delete or edit data","impact":"medium","summary":"Vikunja versions from 2.4.0 before 2.7.1 mix up v1 and v2 API token permission keys, so a token scoped for one action can perform others. An attacker holding a read-only background token can delete project backgrounds, and a bucket create-only token can update existing buckets.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","api-tokens"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"scoped token holders delete project backgrounds or modify buckets","analyst_note":"","how_to_check":"- Check the Vikunja version in use; affected versions are `2.4.0` up to but not including `2.7.1`\n- Review API tokens issued to users and automations for scopes such as project backgrounds or bucket creation","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.7.1-or-later","no-api-tokens"],"who_is_affected":"Teams that self-host Vikunja between versions 2.4.0 and 2.7.1 and issue API tokens to users or automations. Instances on 2.7.1 or later, or those not using API tokens, are not exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":4292,"output_tokens":517,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123527':15A,18A '-2026':14A,17A '2.4.0':30B,78C '2.7.1':32B,80C 'action':48B 'allow':87C 'api':3A,20B,38B,100C 'api-token':19B 'attack':53B,104C 'author':83C 'background':59B,64B,112C,120C 'bucket':67B,75B,123C,131C 'bypass':84C 'collid':2A,96C 'contain':81C 'creat':69B,125C 'create-on':68B,124C 'cve':13A,16A 'data':12A 'delet':9A,62B,114C,119C 'due':94C 'edit':11A 'exist':74B,130C 'hold':54B 'holder':89C 'host':25B 'key':41B,103C 'let':6A 'mix':33B 'one':47B 'oper':93C 'other':51B 'packag':22B 'perform':50B,91C 'permiss':5A,40B,102C 'project':63B,111C 'read':57B,110C 'read-on':56B 'rout':121C 'scope':7A,45B,108C 'self':24B 'self-host':23B 'token':4A,8A,21B,39B,44B,60B,71B,88C,101C,107C,127C 'unintend':92C 'updat':73B,129C 'v1':35B,97C 'v2':37B,99C,118C 'version':28B 'via':116C 'vikunja':1A,26B,27B,76C 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Vikunja between versions 2.4.0 and 2.7.1 and issue API tokens to users or automations. Instances on 2.7.1 or later, or those not using API tokens, are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apitokens","medium","package","selfhosted","vikunja"],"campaign_type":null,"search_a":"'-123527':15A,18A '-2026':14A,17A 'api':3A 'collid':2A 'cve':13A,16A 'data':12A 'delet':9A 'edit':11A 'let':6A 'permiss':5A 'scope':7A 'token':4A,8A 'vikunja':1A","search_b":"'2.4.0':30B '2.7.1':32B 'action':48B 'api':20B,38B 'api-token':19B 'attack':53B 'background':59B,64B 'bucket':67B,75B 'creat':69B 'create-on':68B 'delet':62B 'exist':74B 'hold':54B 'host':25B 'key':41B 'mix':33B 'one':47B 'other':51B 'packag':22B 'perform':50B 'permiss':40B 'project':63B 'read':57B 'read-on':56B 'scope':45B 'self':24B 'self-host':23B 'token':21B,39B,44B,60B,71B 'updat':73B 'v1':35B 'v2':37B 'version':28B 'vikunja':26B,27B","search_c":"'2.4.0':78C '2.7.1':80C 'allow':87C 'api':100C 'attack':104C 'author':83C 'background':112C,120C 'bucket':123C,131C 'bypass':84C 'collid':96C 'contain':81C 'creat':125C 'create-on':124C 'delet':114C,119C 'due':94C 'exist':130C 'holder':89C 'key':103C 'oper':93C 'perform':91C 'permiss':102C 'project':111C 'read':110C 'rout':121C 'scope':108C 'token':88C,101C,107C,127C 'unintend':92C 'updat':129C 'v1':97C 'v2':99C,118C 'via':116C 'vikunja':76C 'vulner':85C","first_public_at":"2026-10-22T10:08:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123527","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123527","severity":null,"published_at":"2026-11-08T02:16:42+00:00","modified_at":"2026-11-08T02:16:42+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","fetched_at":"2026-11-08T02:21:09+00:00","note":null}],"documents":[{"id":99203,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-j5v7-qcwp-5g32","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:08:07+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99204,"url":"https://www.vulncheck.com/advisories/vikunja-2.4.0-before-2.7.1-api-token-scope-collision-authorization-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}