CVE-2026-40103: 
NixOS vulnerability analysis and mitigation

CVE-2026-40103 is a scoped-token authorization bypass vulnerability in Vikunja, an open-source to-do list application, where the API token permission enforcement is method-confused for custom project background routes. A token granted only the projects.background permission (intended for GET access) can successfully invoke the DELETE endpoint to remove a project background, while a token with the explicitly correct projects.background_delete permission is incorrectly rejected. All Vikunja versions prior to 2.3.0 are affected. The vulnerability was published on April 9–10, 2026, and carries a CVSS v3.1 base score of 5.4 (Moderate) (Github Advisory, Feedly).

The root cause is CWE-863 (Incorrect Authorization): the CanDoAPIRoute() function in pkg/models/api_routes.go falls back to a path-derived permission name when evaluating non-CRUD routes, reconstructing the permission from URL path segments without consulting the HTTP method. For a DELETE request to /api/v1/projects/:project/background, the fallback derives the permission name background from the path, causing it to match any token holding projects.background regardless of the intended method restriction. This method-confusion flaw also affected other route clusters such as /projects/:project/views/:view/buckets and leaked CRUD permissions across nested sub-resource groups. Exploitation requires a valid API token issued by a user with project update rights, but the token itself only needs the weaker projects.background scope (Github Advisory, Fix PR).

Successful exploitation allows an authenticated attacker holding a narrowly scoped API token to perform destructive operations beyond the token's intended permissions — specifically, deleting project backgrounds by invoking RemoveProjectBackground(), which deletes the background file, clears the project's BackgroundFileID, and requires project update rights checks. While there is no confidentiality impact, the integrity and availability of project data are affected. The broader method-confusion flaw also means tokens with read-only permissions could have been used to invoke write/delete operations on other shared-path endpoints, weakening the trust model for automation and third-party integrations relying on narrowly scoped tokens (Github Advisory, Fix Commit).

A proof-of-concept is publicly documented in the GitHub Security Advisory, with numbered reproduction steps confirmed locally by the reporter (alecclyde) against commit c5450fb55f5192508638cbb3a6956438452a712e. The EPSS score is approximately 0.033% (10th percentile), indicating low predicted exploitation probability. There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory, Feedly).

1. Obtain a valid account: Log in as a Vikunja user who has update rights on a project that already has a background image set.
2. Create a scoped API token: Generate an API token with only the projects.background permission using the Vikunja API or UI: {"projects":["background"]}.
3. Identify the target project: Note the numeric project ID of the target project with a background.
4. Send the DELETE request: Issue an HTTP DELETE request to the background endpoint using the scoped token:

   DELETE /api/v1/projects/<project_id>/background
   Authorization: Bearer <token>

5. Observe unauthorized success: The server processes the request, deletes the background file, and clears the project's BackgroundFileID — despite the token lacking the projects.background_delete permission.
6. Verify bypass: For confirmation, repeat the same DELETE request with a token scoped to only projects.background_delete and observe it is rejected with 401 Unauthorized, confirming the method-confusion bypass (Github Advisory).

• Network: Unexpected HTTP DELETE requests to /api/v1/projects/<id>/background from API tokens that should only have read (GET) access to that endpoint.
• Logs: Vikunja application logs showing successful DELETE operations on project background routes authenticated via API tokens with only projects.background permission; log entries from CanDoAPIRoute debug output showing token permission mismatches.
• Application State: Project backgrounds unexpectedly removed (null BackgroundFileID) without corresponding user-initiated actions in the UI; background files deleted from storage without a matching admin or owner action.
• API Token Audit: API tokens with projects.background scope that have activity logs showing DELETE method usage against background endpoints.

Upgrade Vikunja to version 2.3.0 or later, which rewrites CanDoAPIRoute() to enforce exact (Path, Method) matching against the stored route details, eliminating the method-confusion fallback (v2.3.0 Release, Fix Commit). As a temporary workaround prior to patching, audit all existing scoped API tokens and revoke or restrict any tokens with projects.background permission that do not require delete capability. Restrict token issuance to the minimum necessary scope and avoid issuing projects.background tokens to untrusted automation until the patch is applied (Github Advisory).

The vulnerability was reported by security researcher alecclyde and published by Vikunja maintainer kolaente on April 9, 2026. The fix was merged the same day via PR #2584, and Vikunja 2.3.0 — which includes 11 security fixes — was released promptly, with the maintainer recommending users update soon (v2.3.0 Release). No significant broader media coverage or notable community controversy has been observed beyond the standard advisory and CVE tracking channels.