Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via improper authorization checks in the CanDoAPIRoute process. An attacker can delete project backgrounds by using an API token with only the projects.background permission, bypassing intended access controls fo...

EUVD-2026-21494

Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds...