Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-33312: Read‑only Vikunja users can delete project background images

CVE-2026-33312 · published 7 months ago

Summary

In Vikunja versions before 2.2.0, the command that removes a project's background picture checks only the permission to view the project, not the permission to change it. As a result, anyone who can only read a project could permanently delete its background image. Upgrade to version 2.2.0 or later to correct the permission check.

What to do

Update code.vikunja.io api to version 2.2.0.
Update api code.vikunja.io/api to version 2.2.0.
Update vikunja vikunja to version 2.2.0 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
go	code.vikunja.io	api	>= 0.20.2, < 2.2.0 Fix: upgrade to 2.2.0
Go	api	code.vikunja.io/api	>= 0.20.2, < 2.2.0 >= 0.20.2 Fix: upgrade to 2.2.0
–	vikunja	vikunja	>= 0.20.2, < 2.2.0 `cpe:2.3:a:vikunja:vikunja::::::::`

Original advisory text

Read-only Vikunja users can delete project background images via broken object-level authorization

Vikunja is an open-source self-hosted task management platform. Starting in version 0.20.2 and prior to version 2.2.0, the `DELETE /api/v1/projects/:project/background` endpoint checks `CanRead` permission instead of `CanUpdate`, allowing any user with read-only access to a project to permanently delete its background image. Version 2.2.0 fixes the issue.

References

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-564f-wx8x-878h Vendor Advisory
https://github.com/advisories/GHSA-564f-wx8x-878h
https://github.com/go-vikunja/vikunja Product
https://vikunja.io/changelog/vikunja-v2.2.0-was-released URL
https://nvd.nist.gov/vuln/detail/CVE-2026-33312 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33312... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-863Incorrect Authorization

Timeline

Published20 Mar 2026

Updated4 Nov 2026

First seen20 Mar 2026

Sources

CVE-2026-33312 · NVD

GHSA-564f-wx8x-878h · GHSA

GHSA-564f-wx8x-878h · OSV

GO-2026-4795 · OSV

CVE-2026-33312 · OSV

Track software like this

Free during beta