CVE-2026-35594
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_sharing.go) constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner deletes a link share or downgrades its permissions, all previously issued JWTs continue to grant the original permission level for up to 72 hours (the default service.jwtttl). This vulnerability is fixed in 2.3.0.
- Affected products
- Vikunja
- Vikunja
- < 2.3.0
- Fix
- Available
- CVSS 3.1
- 6.5 MEDIUM
- EPSS
- 0.3% (19th percentile)
- Weakness
- CWE-613
- NVD status
- Analyzed
- Published
- 2026-04-10
CVE-2026-35594 at NVD
No indexed exploits for CVE-2026-35594 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-35594 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.