{"id":"CVE-2026-40103","aliases":["GHSA-v479-vf79-mg83","GO-2026-5650"],"url":"https://o3.security/vulnerability/CVE-2026-40103","summary":"Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds","details":"### Summary\n\nVikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only `projects.background` can successfully delete a project background, while a token with only `projects.background_delete` is rejected.\n\nThis is a scoped-token authorization bypass.\n\n### Details\n\nI verified this locally on commit `c5450fb55f5192508638cbb3a6956438452a712e`.\n\nRelevant code paths:\n* `pkg/models/api_routes.go`\n* `pkg/routes/routes.go`\n* `pkg/modules/background/handler/background.go`\n\nRoute registration exposes separate permissions for the same path:\n* `GET /api/v1/projects/:project/background` -> `projects.background`\n* `DELETE /api/v1/projects/:project/background` -> `projects.background_delete`\n\nAt enforcement time, `CanDoAPIRoute()` falls back to the parent group and reconstructs the child permission from the path segments only. For the DELETE request, that becomes `background`, so the matcher accepts any token containing `projects.background` without re-checking the HTTP method or matching the stored route detail.\n\nThis matters because `RemoveProjectBackground()` is a real destructive operation:\n* It checks project update rights.\n* It deletes the background file if present.\n* It clears the project's `BackgroundFileID`.\n\n### PoC\n\n1. Log in as a user who can update a project that already has a background.\n2. Create an API token with only:\n   `{\"projects\":[\"background\"]}`\n3. Send:\n   `DELETE /api/v1/projects/<project_id>/background`\n   `Authorization: Bearer <token>`\n4. Observe that the request succeeds and the project background is removed.\n\n**For comparison:**\n1. Create an API token with only:\n   `{\"projects\":[\"background_delete\"]}`\n2. Repeat the same DELETE request.\n3. Observe that the request is rejected with `401 Unauthorized`.\n\nI confirmed this locally with three validations:\n1. `/api/v1/routes` advertises both `background` and `background_delete`.\n2. The matcher unit test proves `CanDoAPIRoute()` accepts DELETE for `background`.\n3. The webtest proves a real API token with only `background` successfully deletes the background.\n\n### Impact\n\nScoped API tokens can exceed their intended capability. A token intended for project background access can delete project backgrounds, which weakens the trust model for automation and third-party integrations that rely on narrowly scoped tokens.\n\nThe attacker needs a valid API token created by a user who has update rights on the target project, but the token itself only needs the weaker `projects.background` permission.","published":"2026-04-10T16:12:27.603Z","modified":"2026-08-12T03:51:12.718546061Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"code.vikunja.io/api","fixedVersion":"2.3.0"}],"fix":{"url":"https://github.com/go-vikunja/vikunja/commit/6a0f39b252a81fa4b19dc56dc889183acc9225ae","label":"go-vikunja/vikunja@6a0f39b"},"references":[{"type":"WEB","url":"https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40103.json"},{"type":"ADVISORY","url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v479-vf79-mg83"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40103"},{"type":"FIX","url":"https://github.com/go-vikunja/vikunja/commit/6a0f39b252a81fa4b19dc56dc889183acc9225ae"},{"type":"FIX","url":"https://github.com/go-vikunja/vikunja/pull/2584"},{"type":"PACKAGE","url":"https://github.com/go-vikunja/vikunja"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:12.718546061Z"}}