---
id: "CVE-2026-123527"
page: "https://infrastack.ai/live/CVE-2026-123527"
kind: "vulnerability"
aliases: ["CVE-2026-123527"]
title: "Vikunja: colliding API token permissions let scoped tokens delete or edit data"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["api-tokens", "package", "self-hosted", "vikunja"]
not_affected_if: ["no-api-tokens", "version-2.7.1-or-later"]
published_at: "2026-11-08T02:16:42+00:00"
first_seen_at: "2026-11-08T02:21:09+00:00"
updated_at: "2026-11-08T02:25:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123527", "first_seen_at": "2026-11-08T02:21:09+00:00"}]
exploit_sources: []
---

# Vikunja: colliding API token permissions let scoped tokens delete or edit data

Link for people: https://infrastack.ai/live/CVE-2026-123527 (this .md is for agents)

Vikunja versions from 2.4.0 before 2.7.1 mix up v1 and v2 API token permission keys, so a token scoped for one action can perform others. An attacker holding a read-only background token can delete project backgrounds, and a bucket create-only token can update existing buckets.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Vikunja version in use; affected versions are `2.4.0` up to but not including `2.7.1`
- Review API tokens issued to users and automations for scopes such as project backgrounds or bucket creation

## Fix

- Vikunja: move to `2.7.1` or later

## Timeline

- 2026-11-08T02:21:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123527

## Documents

- [advisory] Vendor advisory: github.com https://github.com/go-vikunja/vikunja/security/advisories/GHSA-j5v7-qcwp-5g32
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vikunja-2.4.0-before-2.7.1-api-token-scope-collision-authorization-bypass

## From the sources

Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delete them via the v2 DELETE background route, and bucket create-only tokens can update existing buckets.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_