CVE-2026-35598 Details
Description
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV GetResource and GetResourcesByList methods fetch tasks by UID from the database without verifying that the authenticated user has access to the task's project. Any authenticated CalDAV user who knows (or guesses) a task UID can read the full task data from any project on the instance. This vulnerability is fixed in 2.3.0.
A vulnerability exists in Vikunja, an open-source task management platform, in versions prior to 2.3.0. The issue arises in the CalDAV 'GetResource' and 'GetResourcesByList' methods, which retrieve tasks by their unique identifiers (UIDs) without verifying if the authenticated user has access to the corresponding project. This flaw allows any authenticated CalDAV user who knows or guesses a task UID to access full task details from any project on the instance. The vulnerability is particularly concerning in multi-tenant deployments, where it could lead to unauthorized data access across organizational boundaries.
Users can update to Vikunja version 2.3.0, which addresses this vulnerability by implementing the necessary authorization checks in the affected CalDAV methods.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-48ch-p4gq-x46x | CISA-ADP | ExploitVendor Advisory |
| https://github.com/go-vikunja/vikunja/commit/879462d717351fe5d276ddec5246bdec31b41661 | [email protected] | Patch |
| https://github.com/go-vikunja/vikunja/pull/2579 | [email protected] | Issue Tracking |
| https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 | [email protected] | Release Notes |
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-48ch-p4gq-x46x | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vikunja vikunja | < 2.3.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 17, 2026 | Initial Analysis | [email protected] |
| Apr 14, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | New CVE Received | [email protected] |