{"schema_version":"1.7.5","id":"GHSA-564f-wx8x-878h","published":"2026-03-20T17:25:21Z","modified":"2026-03-23T18:56:15.961357Z","aliases":["CVE-2026-33312","GO-2026-4795"],"summary":"Vikunja read-only users can delete project background images via broken object-level authorization","details":"## Summary\n\nThe `DELETE /api/v1/projects/:project/background` endpoint checks `CanRead` permission instead of `CanUpdate`, allowing any user with read-only access to a project to permanently delete its background image.\n\n## Details\n\nThe `RemoveProjectBackground` handler (`pkg/modules/background/handler/background.go`) reuses `checkProjectBackgroundRights`, a helper originally written for the read-only `GetProjectBackground` endpoint. This helper only verifies `CanRead` permission. In contrast, the handler for *setting* a background (`setBackgroundPreparations`) correctly checks `CanUpdate`.\n\nAs a result, destructive write operations (deleting the background file from storage and clearing the project's `background_file_id` and `background_blur_hash` fields) are gated behind a read-only permission check.\n\n## Impact\n\nA user with read-only access to a project — via direct sharing, team membership, link share tokens with read permission, or read-scoped API tokens — can permanently delete the project's background image. The background file is removed from storage and cannot be recovered. This constitutes unauthorized data destruction.\n\n## Reproduction\n\n1. User A creates a project and sets a background image.\n2. User A shares the project with User B with **read-only** permission.\n3. User B sends: `DELETE /api/v1/projects/{project_id}/background` with a valid auth token.\n4. The request succeeds. The background image is permanently deleted.\n\n## References\n\n- `pkg/modules/background/handler/background.go` — `RemoveProjectBackground` (line 416), `checkProjectBackgroundRights` (line 304), `setBackgroundPreparations` (line 106)\n- `pkg/routes/routes.go` line 665 — route registration\n\n## Credits\n\nThis vulnerability was found using [GitHub Security Lab Taskflows](https://github.com/GitHubSecurityLab/seclab-taskflows).","affected":[{"package":{"name":"code.vikunja.io/api","ecosystem":"Go","purl":"pkg:golang/code.vikunja.io/api"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.20.2"},{"fixed":"2.2.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-564f-wx8x-878h/GHSA-564f-wx8x-878h.json"}}],"references":[{"type":"WEB","url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-564f-wx8x-878h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33312"},{"type":"PACKAGE","url":"https://github.com/go-vikunja/vikunja"},{"type":"WEB","url":"https://vikunja.io/changelog/vikunja-v2.2.0-was-released"}],"database_specific":{"cwe_ids":["CWE-863"],"github_reviewed":true,"github_reviewed_at":"2026-03-20T17:25:21Z","nvd_published_at":"2026-03-20T15:16:18Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}