CVE-2026-123527

Vikunja versions 2.4.0 before 2.7.1 are vulnerable to an authorization bypass caused by colliding v1 and v2 API token permission keys. This flaw allows token holders to perform unauthorized operations; specifically, attackers using a token scoped only to read project backgrounds can delete them v...