CVE-2026-35596

Published: Apr 10, 2026Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any authenticated user to read any label that has at least one task association, regardless of project access. Label titles, descriptions, colors, and creator information are exposed. This vulnerability is fixed in 2.3.0.

Affected (1)

Products: Vikunja: Vikunja

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Vikunja Vikunja	Before 2.3.0

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (4)

https://github.com/go-vikunja/vikunja/commit/fc216c38afaa51dd56dde7a97343d2148ecf24c1

Source: security-advisories@github.com

Patch

https://github.com/go-vikunja/vikunja/pull/2578

Source: security-advisories@github.com

Issue Tracking

https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0

Source: security-advisories@github.com

Release Notes

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hj5c-mhh2-g7jq

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.