CVE-2026-33312: Vikunja read-only users can delete project background images via broken object-level authorization

March 20, 2026

The DELETE /api/v1/projects/:project/background endpoint checks CanRead permission instead of CanUpdate, allowing any user with read-only access to a project to permanently delete its background image.

References

github.com/advisories/GHSA-564f-wx8x-878h
github.com/go-vikunja/vikunja
github.com/go-vikunja/vikunja/security/advisories/GHSA-564f-wx8x-878h
nvd.nist.gov/vuln/detail/CVE-2026-33312
vikunja.io/changelog/vikunja-v2.2.0-was-released

Code Behaviors & Features

Detect and mitigate CVE-2026-33312 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →