Vulnerability in Go-Vikunja Vikunja
CVE-2026-35594
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_sharing.go) constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner deletes a link share or downgrades its permissions, all previously issued JWTs continue to grant the original permission level for up to 72 hours (the default service.jwtttl). This vulnerability is fixed in 2.3.0.
EPSS: 0.003 (18.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Go-vikunja Vikunja — versions < 2.3.0
- Vikunja
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2026-35594?
- CVE-2026-35594 is a medium-severity vulnerability in Go-Vikunja Vikunja, classified under Insufficient Session Expiration. CVSS score: 6.5/10. Published 2026-04-10.
- How severe is CVE-2026-35594?
- Medium severity. CVSS v3 base score is 6.5 out of 10.