Read-only Vikunja users can delete project background images via broken object-level authorization

Vikunja is an open-source self-hosted task management platform. In versions 0.20.2 through 2.1.1, the DELETE /api/v1/projects/:project/background endpoint incorrectly checks for CanRead permission instead of CanUpdate [1][3]. This flaw arises because the RemoveProjectBackground handler reuses the checkProjectBackgroundRights helper, which was originally written for the read-only GetProjectBackground endpoint, and only verifies read access [3].

Exploitation

An attacker can exploit this vulnerability by gaining any form of read-only access to a target project. This includes being directly shared a project with read permission, being part of a team with read access, obtaining a link share token with read scope, or possessing a read-scoped API token [3]. No further authentication bypass is required; a valid authenticated request with such read-only credentials to the vulnerable endpoint will succeed.

Impact

Successful exploitation results in the permanent deletion of the project's background image [1][3]. The background file is removed from storage, and the project's background_file_id and background_blur_hash fields are cleared, actions which cannot be undone [3]. This constitutes unauthorized data destruction, affecting the visual integrity of the project for all users.

Mitigation

The vulnerability is fixed in Vikunja version 2.2.0, which was released alongside nine other security fixes [1][2]. Users are strongly advised to update to the latest version; no workaround is mentioned in the advisories [1][2].