Vikunja, an open‑source self‑hosted task management platform, suffered a scoped‑token authorization bypass due to method‑confusion in the custom project background API routes. A token granted the projects.background scope could delete a project background, while a token with the dedicated projects.background_delete scope was correctly rejected. This demonstrates CWE‑836 (Authorization Bypass Through ID Manipulation) and allows an attacker to tamper with project visuals, compromising data integrity without affecting confidentiality or availability.

The vulnerability impacts all installations of the go‑vikunja:vikunja product running a version earlier than 2.3.0. The fix was released in the 2.3.0 release; therefore any deployment using an earlier version remains vulnerable until it is upgraded.

The CVSS base score of 4.3 indicates moderate severity. No EPSS score was provided and the vulnerability is not listed in CISA's KEV catalog. The attack requires only an API token possessing the projects.background scope and the ability to send a standard HTTP request to the background deletion endpoint, making exploitation straightforward for any user who can obtain such a token.