CVE-2026-123527: Security vulnerability

Published Nov 8, 2026

Updated

Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delete them via the v2 DELETE background route, and bucket create-only tokens can update existing buckets.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Vikunja to a version that resolves this vulnerability.
Fixed in 2.7.1

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs a valid Vikunja API token with an affected limited scope. A token allowed to read project backgrounds can delete backgrounds, and a bucket create-only token can update existing buckets.

Which deployments are affected?

Vikunja versions from 2.4.0 up to, but not including, 2.7.1 are affected. The issue concerns API token permissions where v1 and v2 permission keys collide.

What is the immediate mitigation if upgrading is not possible?

Review and restrict or revoke API tokens scoped to reading project backgrounds or creating buckets, especially where token holders should not be able to delete backgrounds or modify existing buckets.

CVE-2026-123527: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What is the immediate mitigation if upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What is the immediate mitigation if upgrading is not possible?