Vikunja versions 2.4.0 through 2.7.1 have a flaw that allows attackers who possess an API token to perform operations they should not be able to perform. The collision of permission keys used in v1 and v2 of the API means a token intended for a narrow scope can unintentionally acquire more rights. For example, a read‑only project background token can delete background images through the v2 DELETE route, and a token that was only meant to create new buckets can update existing buckets. This compromises the integrity of user data and allows malicious actors to remove or modify content they should not control, effectively bypassing the intended authorization model.

The affected product is Vikunja, provided by the go‑vikunja vendor. All releases from 2.4.0 up to but not including 2.7.1 are vulnerable. Users running any of these versions should verify their deployment and consider upgrading.

The CVSS base score of 5.3 indicates a moderate severity. The EPSS score is not currently available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation at present. However, the nature of the abuse – using a legitimate token to perform unintended destructive actions – means that an attacker who gains or already holds an API token can exploit this flaw without additional privilege escalation. The vulnerability is largely bounded to the use of existing tokens, meaning that the attack vector is through valid authentication and does not require additional vulnerabilities or social engineering to be leveraged.