The vulnerability stems from an incorrect permission check on the DELETE /api/v1/projects/:project/background API endpoint. Instead of verifying that the user has the CanUpdate permission, the system checks for CanRead, allowing any user with read‑only access to a project to permanently delete its background image. This unauthorized modification removes a stored asset and violates integrity expectations but does not grant broader system access or cause direct data leakage; it represents a missing authorization check (CWE-863).

The affected software is the Vikunja self‑hosted task‑management platform, produced by go‑vikunja. Versions from 0.20.2 up to just before 2.2.0 are impacted. The vulnerability is fixed in Vikunja 2.2.0, which updates the permission logic to require CanUpdate for deletion. Users running any earlier release should assess whether they have read‑only roles with access to project images.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests low exploitation probability in the wild. It is not listed in the CISA KEV catalog. An attacker needs only an authenticated read‑only account on the target project and can perform the delete operation via the exposed API, making the attack vector remote and low‑effort. The primary impact is loss of the project background image, potentially affecting user experience and visual cues, but it does not compromise data confidentiality or overall system integrity beyond the asset removal.