CVE-2026-40103 is a scoped-token authorization bypass vulnerability in the open-source task management platform Vikunja before version 2.3.0. The issue arises because the API token enforcement for project background routes is method-confused: tokens scoped with projects.background can delete project backgrounds, whereas tokens scoped with projects.background_delete are rejected. This improper scope validation allows unauthorized deletion actions. The vulnerability is classified under CWE-836 (Use of Password Hash Instead of Password for Authentication), though the description focuses on token scope confusion. No official remediation level or patch link is provided in the data, but the issue is fixed in Vikunja 2.3.0.

An attacker with a scoped API token limited to projects.background can delete project backgrounds, bypassing intended authorization restrictions. This results in unauthorized modification of project data (integrity impact) but does not affect confidentiality or availability. The CVSS 3.1 score of 4.3 reflects a medium severity impact with network attack vector, low attack complexity, and requiring privileges with no user interaction.

Upgrade Vikunja to version 2.3.0 or later, where this scoped-token authorization bypass vulnerability is fixed. Since no official patch link or advisory is provided, users should verify the upgrade from the official Vikunja release notes or repository. Until upgraded, restrict API token issuance and monitor for misuse of project background tokens.