CVE-2026-35595
Published: 10 April 2026
Summary
CVE-2026-35595 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Vikunja Vikunja. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 10.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-24 (Access Control Decisions) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for access to system resources, directly addressing the flawed CanUpdate permission check that allowed unauthorized project reparenting.
Employs least privilege to restrict users to only necessary access, mitigating privilege escalation from inherited Write to Admin via manipulated project hierarchy.
Authorizes access based on valid security attributes, countering the recursive CTE misresolution that granted unintended Admin permissions on reparented projects.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
This is a direct privilege escalation vulnerability (CWE-269) in a web application's permission model, allowing authenticated low-privilege users to bypass checks and gain admin-level access via project reparenting.
NVD Description
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/project_permissions.go:139-148 only requires CanWrite on the new parent project when changing parent_project_id. However, Vikunja's permission model uses a recursive CTE that walks up the project…
more
hierarchy to compute permissions. Moving a project under a different parent changes the permission inheritance chain. When a user has inherited Write access (from a parent project share) and reparents the child project under their own project tree, the CTE resolves their ownership of the new parent as Admin (permission level 2) on the moved project. This vulnerability is fixed in 2.3.0.
Deeper analysisAI
CVE-2026-35595 is a privilege escalation vulnerability in Vikunja, an open-source self-hosted task management platform. Affecting versions prior to 2.3.0, the issue resides in the CanUpdate permission check at pkg/models/project_permissions.go:139-148, which only verifies CanWrite access on the new parent project when modifying the parent_project_id. Vikunja's permission model relies on a recursive common table expression (CTE) to traverse the project hierarchy and compute effective permissions. Reparenting a project alters this inheritance chain, enabling unintended escalation. The vulnerability carries a CVSS v3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) and is classified under CWE-269 (Improper Privilege Management).
An authenticated attacker with low privileges (PR:L) who has inherited Write access via a shared parent project can exploit this by reparenting the target child project under a project they own or control. The recursive CTE then resolves their ownership of the new parent as granting Admin-level permissions (level 2) on the moved project, bypassing stricter access controls. This allows network-based exploitation without user interaction, potentially leading to high-impact confidentiality and integrity violations, such as unauthorized data access, modification, or limited availability disruption on the affected project.
Mitigation is available in Vikunja version 2.3.0, which addresses the flawed permission check. Security practitioners should upgrade to this release immediately. Relevant resources include the fixing commit (https://github.com/go-vikunja/vikunja/commit/c03d682f48aff890eeb3c8b41d38226069722827), pull request (https://github.com/go-vikunja/vikunja/pull/2583), release notes (https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0), and the GitHub security advisory (https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2vq4-854f-5c72).
Details
- CWE(s)