Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via improper authorization checks in the CanDoAPIRoute process. An attacker can delete project backgrounds by using an API token with only the projects.background permission, bypassing intended access controls fo...

CVE-2026-33315

creationtimestamp| type| source ---|---|--- 2026-03-20 13:49:29+00:00| published-proof-of-concept| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-47cr-f226-r4pq...