Nixpkgs Security Tracker

Untriaged

Permalink CVE-2026-33312

created 1 day, 14 hours ago

Read-only Vikunja users can delete project background images via broken object-level authorization

Vikunja is an open-source self-hosted task management platform. Starting in version 0.20.2 and prior to version 2.2.0, the `DELETE /api/v1/projects/:project/background` endpoint checks `CanRead` permission instead of `CanUpdate`, allowing any user with read-only access to a project to permanently delete its background image. Version 2.2.0 fixes the issue.

References

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-564f-wx8x-878h x_refsource_CONFIRM
https://vikunja.io/changelog/vikunja-v2.2.0-was-released x_refsource_MISC

Affected products

vikunja

==>= 0.20.2, < 2.2.0

Matching in nixpkgs

pkgs.vikunja

Todo-app to organize your life

nixos-unstable 2.1.0
- nixpkgs-unstable 2.1.0
- nixos-unstable-small 2.1.0
nixos-25.11 2.1.0
- nixos-25.11-small 2.1.0
- nixpkgs-25.11-darwin 2.1.0

pkgs.vikunja-desktop

Desktop App of the Vikunja to-do list app

nixos-unstable 2.1.0
- nixpkgs-unstable 2.1.0
- nixos-unstable-small 2.1.0

Package maintainers