CVE-2026-35596

Description

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any authenticated user to read any label that has at least one task association, regardless of project access. Label titles, descriptions, colors, and creator information are exposed. This vulnerability is fixed in 2.3.0.

PUBLISHED Reserved 2026-04-03 | Published 2026-04-10 | Updated 2026-04-14 | Assigner GitHub_M

Problem types

CWE-863: Incorrect Authorization

Product status

References

github.com/...ikunja/security/advisories/GHSA-hj5c-mhh2-g7jq

github.com/go-vikunja/vikunja/pull/2578

github.com/...ommit/fc216c38afaa51dd56dde7a97343d2148ecf24c1

github.com/go-vikunja/vikunja/releases/tag/v2.3.0

cve.org (CVE-2026-35596)

nvd.nist.gov (CVE-2026-35596)

Download JSON