{"id":"CVE-2026-33312","aliases":["GHSA-564f-wx8x-878h","GO-2026-4795"],"url":"https://o3.security/vulnerability/CVE-2026-33312","summary":"Read-only Vikunja users can delete project background images via broken object-level authorization","details":"## Summary\n\nThe `DELETE /api/v1/projects/:project/background` endpoint checks `CanRead` permission instead of `CanUpdate`, allowing any user with read-only access to a project to permanently delete its background image.\n\n## Details\n\nThe `RemoveProjectBackground` handler (`pkg/modules/background/handler/background.go`) reuses `checkProjectBackgroundRights`, a helper originally written for the read-only `GetProjectBackground` endpoint. This helper only verifies `CanRead` permission. In contrast, the handler for *setting* a background (`setBackgroundPreparations`) correctly checks `CanUpdate`.\n\nAs a result, destructive write operations (deleting the background file from storage and clearing the project's `background_file_id` and `background_blur_hash` fields) are gated behind a read-only permission check.\n\n## Impact\n\nA user with read-only access to a project — via direct sharing, team membership, link share tokens with read permission, or read-scoped API tokens — can permanently delete the project's background image. The background file is removed from storage and cannot be recovered. This constitutes unauthorized data destruction.\n\n## Reproduction\n\n1. User A creates a project and sets a background image.\n2. User A shares the project with User B with **read-only** permission.\n3. User B sends: `DELETE /api/v1/projects/{project_id}/background` with a valid auth token.\n4. The request succeeds. The background image is permanently deleted.\n\n## References\n\n- `pkg/modules/background/handler/background.go` — `RemoveProjectBackground` (line 416), `checkProjectBackgroundRights` (line 304), `setBackgroundPreparations` (line 106)\n- `pkg/routes/routes.go` line 665 — route registration\n\n## Credits\n\nThis vulnerability was found using [GitHub Security Lab Taskflows](https://github.com/GitHubSecurityLab/seclab-taskflows).","published":"2026-03-20T14:42:14.137Z","modified":"2026-08-12T03:51:10.260370369Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"code.vikunja.io/api","fixedVersion":"2.2.0"}],"fix":null,"references":[{"type":"WEB","url":"https://vikunja.io/changelog/vikunja-v2.2.0-was-released"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33312.json"},{"type":"ADVISORY","url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-564f-wx8x-878h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33312"},{"type":"PACKAGE","url":"https://github.com/go-vikunja/vikunja"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:10.260370369Z"}}