| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| code.vikunja.io/api | ≥ 0.20.2, < 2.2.0≥ 0.20.2 | 2.2.0 |
| vikunja | ≥ 0.20.2, < 2.2.0 | 2.2.0 |
The DELETE /api/v1/projects/:project/background endpoint checks CanRead permission instead of CanUpdate, allowing any user with read-only access to a project to permanently delete its background image.
The RemoveProjectBackground handler (pkg/modules/background/handler/background.go) reuses checkProjectBackgroundRights, a helper originally written for the read-only GetProjectBackground endpoint. This helper only verifies CanRead permission. In contrast, the handler for setting a background (setBackgroundPreparations) correctly checks CanUpdate.
As a result, destructive write operations (deleting the background file from storage and clearing the project's background_file_id and background_blur_hash fields) are gated behind a read-only permission check.
A user with read-only access to a project — via direct sharing, team membership, link share tokens with read permission, or read-scoped API tokens — can permanently delete the project's background image. The background file is removed from storage and cannot be recovered. This constitutes unauthorized data destruction.
DELETE /api/v1/projects/{project_id}/background with a valid auth token.pkg/modules/background/handler/background.go — RemoveProjectBackground (line 416), checkProjectBackgroundRights (line 304), setBackgroundPreparations (line 106)pkg/routes/routes.go line 665 — route registrationThis vulnerability was found using GitHub Security Lab Taskflows.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí