EUVD-2026-13708
GHSA-564f-wx8x-878h
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Although CVSS and EPSS scores are not provided in the available intelligence, the vulnerability presents moderate-to-high real-world risk based on available signals: (1) Attack Vector is Network with likely Low Complexity, as the endpoint is part of the public API; (2) Exploitation requires only read-only access, a low privilege requirement; (3) Technical Impact is high—permanent deletion of project assets; (4) The vulnerability affects a collaborative tool where read-only users are common, increasing the attack surface; (5) A patch is available (version 2.2.0), indicating the vendor validated the issue and resolved it. The primary risk is insider threat or compromised low-privilege accounts, rather than unauthenticated external exploitation. Organizations running Vikunja 0.20.2–2.1.x with multiple users should prioritize patching. |
| Exploit ScenarioDerived | A malicious insider or user with a compromised low-privilege account gains read-only access to a shared project (common in collaborative task management). The attacker uses the misconfigured DELETE endpoint directly via HTTP DELETE request to /api/v1/projects/{project_id}/background, bypassing normal UI permission checks because the backend only validates CanRead instead of CanUpdate. The background image is permanently deleted, disrupting project visibility and aesthetics for all team members. No special tools or advanced exploitation techniques are required; a simple curl command or browser developer tools suffice. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
A permission-check bypass vulnerability exists in Vikunja versions 0.20.2 through 2.1.x where the DELETE /api/v1/projects/:project/background endpoint incorrectly validates CanRead permissions instead of CanUpdate permissions, allowing read-only project members to permanently delete a project's background image. This affects the go-vikunja:vikunja product family, and the vulnerability has been patched in version 2.2.0 as documented in the GitHub security advisory GHSA-564f-wx8x-878h.
RemediationAI
Upgrade Vikunja to version 2.2.0 or later immediately. This patch corrects the authorization logic to require CanUpdate permissions for background deletion. Users unable to upgrade immediately should restrict project read-only access to trusted users only, implement network-level access controls to limit API exposure, and audit project member permissions to remove unnecessary read-only grants. For self-hosted deployments, consider temporarily disabling background image functionality via configuration if available. Consult the vendor advisory at https://github.com/go-vikunja/vikunja/security/advisories/GHSA-564f-wx8x-878h for deployment-specific guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vikunja is an open-source self-hosted task management platform written in Go (cpe:2.3:a:go-vikunja:vikunja). The vulnerability stems from incorrect authorization logic in the REST API endpoint responsible for background image management. The root cause is classified under CWE-863 (Incorrect Authorization), a design-level flaw where the application fails to enforce proper role-based access control. Specifically, the endpoint checks for read-only access (CanRead capability) when it should enforce write or administrative access (CanUpdate capability), allowing privilege escalation where read-only users can perform destructive administrative operations on shared project resources.
Know when Vikunja gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Vikunja is an open-source self-hosted task management platform. Starting in version 0.20.2 and prior to version 2.2.0, the DELETE /api/v1/projects/:project/background endpoint checks CanRead permission instead of CanUpdate, allowing any user with read-only access to a project to permanently delete its background image. Version 2.2.0 fixes the issue.
Executive ViewAI
Organizations using version 0.20.2 and should be aware of moderate risk from CVE-2026-33312, a incorrect authorization vulnerability rated CVSS 5.4. Attackers could gain access beyond their authorized level. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Vikunja Task Management Authorization Issues
View all 3Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any
Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC avai
Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully cont
Stored cross-site scripting (XSS) in Vikunja prior to version 2.0.0 allows authenticated attackers to steal authenticati
Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to va
Vikunja is an open-source self-hosted task management platform. [CVSS 6.1 MEDIUM]
Business logic vulnerability in Vikunja task management platform before 2.1.0 allows incomplete resource cleanup, potent
Instance-wide data breach in Vikunja before 2.2.1 lets remote attackers exfiltrate and destroy every file attachment acr
Vikunja's OIDC callback handler issues a full JWT to any successfully matched user without checking whether that account
Vikunja instances before 2.6.0 expose CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) that are not covered b
Vikunja versions before 2.6.0 ship authentication endpoints under /api/v2 (login, register, password-reset, and OAuth to
Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint,
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB