PT-2026-31949 · Vikunja · Vikunja

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-35598

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.3.0

Description The CalDAV GetResource and GetResourcesByList methods retrieve tasks by UID from the database without verifying the authenticated user's access to the task's project. This allows any authenticated CalDAV user who knows or guesses a task UID to read the full task data from any project. The GetTasksByUIDs function at pkg/models/tasks.go:376-393 performs a global database query without authorization checks, accepting a web.Auth parameter that is not used for permission filtering. This function is called by GetResource and GetResourcesByList within the CalDAV implementation. The project ID in the CalDAV URL is ignored, meaning a user can access tasks from other projects using a known UID. Task UIDs are UUIDv4 and are exposed in CalDAV resource paths and client synchronization logs.

Recommendations Add a CanRead permission check on each returned task's project in both GetResource and GetResourcesByList.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-35598

GHSA-48CH-P4GQ-X46X

Affected Products

Vikunja

References · 8

• 🔥 https://github.com/go-vikunja/vikunja/security/advisories/GHSA-48ch-p4gq-x46x · Exploit
• https://github.com/go-vikunja/vikunja/commit/879462d717351fe5d276ddec5246bdec31b41661 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-35598 · Security Note
• https://osv.dev/vulnerability/GHSA-48ch-p4gq-x46x · Vendor Advisory
• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 · Note
• https://github.com/go-vikunja/vikunja · Note
• https://github.com/go-vikunja/vikunja/pull/2579 · Note
• https://twitter.com/CVEnew/status/2042710239326163411 · Twitter Post