CVE-2026-35594

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-35594
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_sharing.go) constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner deletes a link share or downgrades its permissions, all previously issued JWTs continue to grant the original permission level for up to 72 hours (the default service.jwtttl). This vulnerability is fixed in 2.3.0.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/go-vikunja/vikunja/commit/379d8a5c19334ffe4846003f590e202c31a75479 Patch
https://github.com/go-vikunja/vikunja/pull/2581 Issue Tracking
https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 Release Notes
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-96q5-xm3p-7m84 Exploit Vendor Advisory
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-96q5-xm3p-7m84 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*
History

24 Apr 2026, 14:53

Type Values Removed Values Added
CPE cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*
First Time Vikunja
Vikunja vikunja
References () https://github.com/go-vikunja/vikunja/commit/379d8a5c19334ffe4846003f590e202c31a75479 - () https://github.com/go-vikunja/vikunja/commit/379d8a5c19334ffe4846003f590e202c31a75479 - Patch
References () https://github.com/go-vikunja/vikunja/pull/2581 - () https://github.com/go-vikunja/vikunja/pull/2581 - Issue Tracking
References () https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 - () https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 - Release Notes
References () https://github.com/go-vikunja/vikunja/security/advisories/GHSA-96q5-xm3p-7m84 - () https://github.com/go-vikunja/vikunja/security/advisories/GHSA-96q5-xm3p-7m84 - Exploit, Vendor Advisory

14 Apr 2026, 15:16

Type Values Removed Values Added
References () https://github.com/go-vikunja/vikunja/security/advisories/GHSA-96q5-xm3p-7m84 - () https://github.com/go-vikunja/vikunja/security/advisories/GHSA-96q5-xm3p-7m84 -

10 Apr 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-10 16:16

Updated : 2026-04-24 14:53

NVD link : CVE-2026-35594

Mitre link : CVE-2026-35594

CVE.ORG link : CVE-2026-35594

JSON object : View

Products Affected

vikunja

  • vikunja
CWE
CWE-613

Insufficient Session Expiration