VulnerabilityAnalyzed
CVE-2026-35594
This vulnerability is fixed in 2.3.0.
MEDIUM 6.5EPSS 0.27%
Does this matter?
Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.
Description
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_sharing.go) constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner deletes a link share or downgrades its permissions, all previously issued JWTs continue to grant the original permission level for up to 72 hours (the default service.jwtttl). This vulnerability is fixed in 2.3.0.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 0.27% probability · 19th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-613
- Affected
- vikunja/vikunja
- Source
- security-advisories@github.com
References
- https://github.com/go-vikunja/vikunja/commit/379d8a5c19334ffe4846003f590e202c31a75479Patch
- https://github.com/go-vikunja/vikunja/pull/2581Issue Tracking
- https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0Release Notes
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-96q5-xm3p-7m84Exploit, Vendor Advisory
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-96q5-xm3p-7m84Exploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.