PT-2026-31947 · Vikunja · Vikunja

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-35596

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.3.0

Description A SQL operator precedence bug exists in the hasAccessToLabel function. This allows any authenticated user to read any label that has at least one task association, regardless of project access. Exposed information includes label titles, descriptions, colors, and creator information. The issue stems from an improperly grouped SQL query in pkg/models/label permissions.go:85-91, where the lack of proper grouping allows bypassing project access restrictions. The vulnerability allows cross-project information disclosure, exposing creator usernames and display names. An estimated number of affected devices or real-world incidents are not mentioned.

Recommendations Update to version 2.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the hasAccessToLabel function until a patch is available.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-35596

GHSA-HJ5C-MHH2-G7JQ

Affected Products

Vikunja

References · 9

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hj5c-mhh2-g7jq · Vendor Advisory
• https://github.com/go-vikunja/vikunja/commit/fc216c38afaa51dd56dde7a97343d2148ecf24c1 · Patch
• https://osv.dev/vulnerability/GHSA-hj5c-mhh2-g7jq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35596 · Security Note
• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 · Note
• https://github.com/go-vikunja/vikunja · Note
• https://github.com/go-vikunja/vikunja/pull/2578 · Note
• https://twitter.com/infoflowcloud/status/2042710863392473559 · Twitter Post
• https://twitter.com/CVEnew/status/2042710274734440475 · Twitter Post