Authorization bypass in Vikunja API token scopes
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass because the v1 and v2 API token permission keys collide, classified as CWE-863 (Incorrect Authorization). A token holder can perform operations it was not granted: a token scoped to read project backgrounds can delete them through the v2 DELETE background route, and bucket create-only tokens can update existing buckets. An attacker needs a valid API token with low privileges over the network, and the flaw can change or remove data in the affected project. CISA has not added it to KEV.
Written with Claude Haiku 5.5 from the sources below · 2026-11-08
Description from the CNA
Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delete them via the v2 DELETE background route, and bucket create-only tokens can update existing buckets.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| go-vikunja | vikunja | 2.4.0 to before 2.7.1 | 2.7.1 | Patch available | CNA |
- vikunja Vendorgo-vikunja Affected 2.4.0 to before 2.7.1 Fixed in 2.7.1 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* | — | — | go-vikunja |
- cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* Versions — — ·go-vikunja
Remediation
Upgrade Vikunja to version 2.7.1, the first fixed version listed for the vikunja product.
Written with Claude Haiku 5.5 from the sources below · 2026-11-08
- Fix · CNA vikunja (go-vikunja) Fixed in 2.7.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
go-vikunja vikunja 2.7.1
39 records Highest priority Priority MEDIUM 20 MEDIUM, 19 LOW
Other records, highest priority first
- TI-2026-86673 Pagination limit bypass in Vikunja lets users exhaust resourcesPriority MEDIUM 53
- TI-2026-86654 Vikunja exposes password-reset tokens in access logsPriority MEDIUM 52
- TI-2026-86670 Insufficient session expiration in Vikunja token middlewarePriority MEDIUM 48
Timeline
- 2026-11-08 Threatist record created from CVE-2026-123527
- 2026-11-08 Alias added: GHSA-w4rp-qjww-56rf
References
More go-vikunja vulnerabilities
- TI-2026-40929 Authorization bypass in go-vikunja Vikunja CVSS 4.0CRITICAL 9.3
- TI-2026-21967 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change CVSS 3.1CRITICAL 9.1
- TI-2026-62115 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash CVSS 4.0HIGH 8.7
- TI-2026-62108 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth CVSS 4.0HIGH 8.7
- TI-2026-62107 Vikunja before 2.6.0 Authentication Bypass via Unthrottled API CVSS 4.0HIGH 8.7
- TI-2026-26971 Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-123527 · CVE Program
- CVE-2026-123527 · NVD
- GHSA-w4rp-qjww-56rf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences