Vikunja is an open-source self-hosted task management platform. Starting in version 0.20.2 and prior to version 2.2.0, the `DELETE /api/v1/projects/:project/background` endpoint checks `CanRead` permission instead of `CanUpdate`, allowing any user with read-only access to a project to permanently delete its background image. Version 2.2.0 fixes the issue.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-564f-wx8x-878h | Vikunja read-only users can delete project background images via broken object-level authorization |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 20 Mar 2026 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Vikunja is an open-source self-hosted task management platform. Starting in version 0.20.2 and prior to version 2.2.0, the `DELETE /api/v1/projects/:project/background` endpoint checks `CanRead` permission instead of `CanUpdate`, allowing any user with read-only access to a project to permanently delete its background image. Version 2.2.0 fixes the issue. | |
| Title | Read-only Vikunja users can delete project background images via broken object-level authorization | |
| Weaknesses | CWE-863 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-03-20T14:42:14.137Z
Reserved: 2026-03-18T21:23:36.676Z
Link: CVE-2026-33312
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-20T15:16:18.010
Modified: 2026-03-20T15:16:18.010
Link: CVE-2026-33312
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses