Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123527Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass
Medium 5.4
In plain English
A medium-severity incorrect authorization in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delete them via the v2 DELETE background route, and bucket create-only tokens can update existing buckets.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 2.4.0 – before 2.7.1 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
References
- GitHub Security Advisory (GHSA-j5v7-qcwp-5g32) vendor-advisory
- VulnCheck Advisory: Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass third-party-advisory