CVE-2026-35596

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any authenticated user to read any label that has at least one task association, regardless of project access. Label titles, descriptions, colors, and creator information are exposed. This vulnerability is fixed in 2.3.0.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/go-vikunja/vikunja/commit/fc216c38afaa51dd56dde7a97343d2148ecf24c1	Patch
https://github.com/go-vikunja/vikunja/pull/2578	Issue Tracking
https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0	Release Notes
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hj5c-mhh2-g7jq	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Vikunja es una plataforma de gestión de tareas de código abierto autoalojada. Antes de la versión 2.3.0, la función hasAccessToLabel contiene un error de precedencia de operadores SQL que permite a cualquier usuario autenticado leer cualquier etiqueta que tenga al menos una asociación de tarea, independientemente del acceso al proyecto. Los títulos de las etiquetas, las descripciones, los colores y la información del creador quedan expuestos. Esta vulnerabilidad está corregida en la versión 2.3.0.

Information

Published : 2026-04-10 17:17

Updated : 2026-10-26 22:10

NVD link : CVE-2026-35596

Mitre link : CVE-2026-35596

CVE.ORG link : CVE-2026-35596

JSON object : View

Products Affected

vikunja

vikunja

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-35596", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35596", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T14:51:36.685636Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "go-vikunja", "product": "vikunja", "versions": [{"status": "affected", "version": "< 2.3.0"}]}]}], "published": "2026-04-10T17:17:03.067", "references": [{"url": "https://github.com/go-vikunja/vikunja/commit/fc216c38afaa51dd56dde7a97343d2148ecf24c1", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/go-vikunja/vikunja/pull/2578", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hj5c-mhh2-g7jq", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any authenticated user to read any label that has at least one task association, regardless of project access. Label titles, descriptions, colors, and creator information are exposed. This vulnerability is fixed in 2.3.0."}, {"lang": "es", "value": "Vikunja es una plataforma de gesti\u00f3n de tareas de c\u00f3digo abierto autoalojada. Antes de la versi\u00f3n 2.3.0, la funci\u00f3n hasAccessToLabel contiene un error de precedencia de operadores SQL que permite a cualquier usuario autenticado leer cualquier etiqueta que tenga al menos una asociaci\u00f3n de tarea, independientemente del acceso al proyecto. Los t\u00edtulos de las etiquetas, las descripciones, los colores y la informaci\u00f3n del creador quedan expuestos. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.3.0."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC8B46CF-6E7B-46F4-8275-D1A38F2A6D5E", "versionEndExcluding": "2.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}