CVE-2026-35595 - Vulnerability Analysis

Overview

Vikunja < 2.3.0 contains a broken access control vulnerability caused by improper permission checks when changing parent_project_id, letting users escalate permissions to Admin on moved projects, exploit requires user with inherited Write access.

Severity & Score

Impact

Users can escalate their permissions to Admin on projects by changing project parentage, potentially leading to unauthorized project control.

Mitigation

Update to version 2.3.0 or later.

References

• https://github.com/go-vikunja/vikunja/pull/2583
• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2vq4-854f-5c72
• https://github.com/go-vikunja/vikunja/commit/c03d682f48aff890eeb3c8b41d38226069722827

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner