CVE-2026-123527
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delete them via the v2 DELETE background route, and bucket create-only tokens can update existing buckets.