CVE-2026-123527
Deferred Deferred - Pending Action

Authorization Bypass in Vikunja via API Token Collision

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delete them via the v2 DELETE background route, and bucket create-only tokens can update existing buckets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123527
EUVD
EUVD-2026-119412

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja vikunja From 2.4.0 (inc) to 2.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in Vikunja versions 2.4.0 to 2.7.0 where v1 and v2 API token permission keys collide. This causes tokens with limited scopes to gain unintended permissions. For example, a token meant to read project backgrounds can delete them via the v2 API, and bucket create-only tokens can update existing buckets.

Detection Guidance

Check Vikunja version with 'vikunja version' or inspect API responses for v1/v2 token scope collisions. Monitor logs for unexpected DELETE operations on project backgrounds or PUT/POST mismatches in bucket operations.

Impact Analysis

Attackers with a token scoped to read project backgrounds could delete those backgrounds. Bucket create-only tokens could update existing buckets. This could lead to data loss or unauthorized modifications in Vikunja instances using affected versions.

Mitigation Strategies

Upgrade Vikunja to version 2.7.1 or later immediately. Review and revoke all API tokens, especially those with project.background or bucket scopes, then reissue tokens with explicit permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123527. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...