CVE-2026-35594

Published: Apr 10, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: security-advisories@github.com (Secondary)

Description

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_sharing.go) constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner deletes a link share or downgrades its permissions, all previously issued JWTs continue to grant the original permission level for up to 72 hours (the default service.jwtttl). This vulnerability is fixed in 2.3.0.

Affected (1)

Products: Vikunja: Vikunja

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Vikunja Vikunja	Before 2.3.0

Related CWEs

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (5)

https://github.com/go-vikunja/vikunja/commit/379d8a5c19334ffe4846003f590e202c31a75479

Source: security-advisories@github.com

Patch

https://github.com/go-vikunja/vikunja/pull/2581

Source: security-advisories@github.com

Issue Tracking

https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0

Source: security-advisories@github.com

Release Notes

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-96q5-xm3p-7m84

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-96q5-xm3p-7m84

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.