CVE-2026-35595

{
  "id": "CVE-2026-35595",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-10T17:17:02.910",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/project_permissions.go:139-148 only requires CanWrite on the new parent project when changing parent_project_id. However, Vikunja's permission model uses a recursive CTE that walks up the project hierarchy to compute permissions. Moving a project under a different parent changes the permission inheritance chain. When a user has inherited Write access (from a parent project share) and reparents the child project under their own project tree, the CTE resolves their ownership of the new parent as Admin (permission level 2) on the moved project. This vulnerability is fixed in 2.3.0."
    },
    {
      "lang": "es",
      "value": "Vikunja es una plataforma de gestión de tareas de código abierto y autoalojada. Antes de la versión 2.3.0, la comprobación CanUpdate en pkg/models/project_permissions.go:139-148 solo requiere CanWrite en el nuevo proyecto padre al cambiar el parent_project_id. Sin embargo, el modelo de permisos de Vikunja utiliza una CTE recursiva que recorre la jerarquía del proyecto para calcular los permisos. Mover un proyecto bajo un padre diferente cambia la cadena de herencia de permisos. Cuando un usuario ha heredado acceso de escritura (de un recurso compartido de proyecto padre) y reasigna el proyecto hijo bajo su propio árbol de proyectos, la CTE resuelve su propiedad del nuevo padre como Administrador (nivel de permiso 2) en el proyecto movido. Esta vulnerabilidad se corrige en la versión 2.3.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "go-vikunja",
          "product": "vikunja",
          "versions": [
            {
              "version": "< 2.3.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-10T18:16:09.962505Z",
          "id": "CVE-2026-35595",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.3.0",
              "matchCriteriaId": "CC8B46CF-6E7B-46F4-8275-D1A38F2A6D5E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/go-vikunja/vikunja/commit/c03d682f48aff890eeb3c8b41d38226069722827",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/go-vikunja/vikunja/pull/2583",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking"
      ]
    },
    {
      "url": "https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2vq4-854f-5c72",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}