CVE-2026-35596: Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug
Vulnerability summary
CVE-2026-35596 is a medium (CVSS 4.3) Incorrect Authorization vulnerability in go-vikunja vikunja. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 10-04-2026PublishedVulnerability first disclosed.
- 14-04-2026Last modifiedVulnerability information updated.
Description
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any authenticated user to read any label that has at least one task association, regardless of project access. Label titles, descriptions, colors, and creator information are exposed. This vulnerability is fixed in 2.3.0.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
Increase +0.08 pp
From 0.27% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundVikunja
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Code.vikunja.io1 product
- api< 2.3.0 | All versions (No fix recorded)
Go-vikunja1 product
- vikunja< 2.3.0
Vikunja1 product
- vikunja< 2.3.0
3 vendors · 3 products
References
5 links- github.com/go-vikunja/vikunja/security/advisories/GHSA-hj5c-mhh2-g7jqX Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
- github.com/go-vikunja/vikunja/commit/fc216c38afaa51dd56dde7a97343d2148ecf24c1X Refsource MISCWEBPatch