{"id":"CVE-2026-35594","sourceIdentifier":"security-advisories@github.com","published":"2026-04-10T16:16:32.000","lastModified":"2026-10-26T21:10:00.170","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_sharing.go) constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner deletes a link share or downgrades its permissions, all previously issued JWTs continue to grant the original permission level for up to 72 hours (the default service.jwtttl). This vulnerability is fixed in 2.3.0."},{"lang":"es","value":"Vikunja es una plataforma de gestión de tareas de código abierto autoalojada. Antes de 2.3.0, la autenticación de enlaces compartidos de Vikunja (GetLinkShareFromClaims en pkg/models/link_sharing.go) construye objetos de autorización completamente a partir de las claims de JWT sin ninguna validación de base de datos del lado del servidor. Cuando el propietario de un proyecto elimina un enlace compartido o degrada sus permisos, todos los JWT emitidos previamente continúan otorgando el nivel de permiso original por hasta 72 horas (el service.jwtttl predeterminado). Esta vulnerabilidad se corrige en 2.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"go-vikunja","product":"vikunja","versions":[{"version":"< 2.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-14T14:32:11.692055Z","id":"CVE-2026-35594","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*","versionEndExcluding":"2.3.0","matchCriteriaId":"CC8B46CF-6E7B-46F4-8275-D1A38F2A6D5E"}]}]}],"references":[{"url":"https://github.com/go-vikunja/vikunja/commit/379d8a5c19334ffe4846003f590e202c31a75479","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/go-vikunja/vikunja/pull/2581","source":"security-advisories@github.com","tags":["Issue Tracking"]},{"url":"https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-96q5-xm3p-7m84","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-96q5-xm3p-7m84","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}