CVE-2026-40103 - Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds
CVE ID :CVE-2026-40103
Published : April 10, 2026, 5:17 p.m. | 49 minutes ago
Description :Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped AP...
Related Vulnerabilities
- CVE-2026-5986: A weakness has been identified in Zod jsVideoUrlParser up to 0.5.1. The impacted element is the func MEDIUM
- CVE-2026-6004: A vulnerability was detected in code-projects Simple IT Discussion Forum 1.0. Impacted is an unknown MEDIUM
- CVE-2026-32894: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Obj HIGH
- CVE-2026-40259: SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via `/api/av/removeUnusedAttribut HIGH
- CVE-2026-40086: Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the MEDIUM
Related Coverage
Threat Actors