CVE-2026-40103: Vikunja authorization bypass in scoped API tokens

Executive brief

Vikunja's scoped API token enforcement for custom project background routes is method-confused, allowing tokens with read-only permissions to perform delete operations.

Affected products

• go code.vikunja.io/api
• vikunja vikunja

References

• https://api.github.com/users/alecclyde
• https://github.com/alecclyde
• https://api.github.com/users/alecclyde/gists%7B/gist_id%7D
• https://api.github.com/users/alecclyde/repos
• https://avatars.githubusercontent.com/u/32017824?v=4
• https://api.github.com/users/alecclyde/events%7B/privacy%7D