Threats tagged 'ghsa-w4rp-qjww-56rf'

Vikunja versions from 2.4.0 up to but not including 2.7.1 contain an authorization bypass vulnerability. This flaw arises from colliding permission keys between v1 and v2 API tokens, allowing token holders to perform unauthorized actions. Specifically, tokens scoped only for reading project backgrounds can delete them via the v2 DELETE background endpoint, and tokens limited to bucket creation can update existing buckets.