CVE-2026-40103
Medium · 4.3CVSS
4.3
EPSS
0.3%
Published
Apr 10, 2026
CISA due date
—
The record
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background, while a token with only projects.background_delete is rejected. This is a scoped-token authorization bypass. This vulnerability is fixed in 2.3.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-44736 OpenProject is open-source, web-based project management software. CWE-836
- CVE-2026-9222 Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only… CWE-836
- CVE-2019-25552 CEWE PHOTO SHOW 6.4.3 contains a denial of service vulnerability that allows attackers to… CWE-836