CVE-2026-35595

HIGH EPSS 20.7%
Published Apr 10, 20262mo ago · Modified Jun 17, 20261w ago
8.3 CVSS 3.1
High
Find Similar
Published Apr 10, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago

Description

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/project_permissions.go:139-148 only requires CanWrite on the new parent project when changing parent_project_id. However, Vikunja's permission model uses a recursive CTE that walks up the project hierarchy to compute permissions. Moving a project under a different parent changes the permission inheritance chain. When a user has inherited Write access (from a parent project share) and reparents the child project under their own project tree, the CTE resolves their ownership of the new parent as Admin (permission level 2) on the moved project. This vulnerability is fixed in 2.3.0.

CVSS Details

Base Score
8.3
Exploitability
2.8
Impact
5.5
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability Low

Threat Intelligence

EPSS Exploit Probability
20.7% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-269 Improper Privilege Management Authorization

Affected Products 1

VendorProductVersionRange
vikunjavikunja* <2.3.0

References 4

  • github.com https://github.com/go-vikunja/vikunja/commit/c03d682f48aff890eeb3c8b41d38226069722827
    Patch
  • github.com https://github.com/go-vikunja/vikunja/pull/2583
    Issue Tracking
  • github.com https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0
    Release Notes
  • github.com https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2vq4-854f-5c72
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/go-vikunja/vikunja/commit/c03d682f48aff890eeb3c8b41d38226069722827
    Patch