Read the docs
TI-2026-27697 Aliases CVE-2026-35594GHSA-96q5-xm3p-7m84

Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade

Priority HIGH 68CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-613.

Summary

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_sharing.go) constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner deletes a link share or downgrades its permissions, all previously issued JWTs continue to grant the original permission level for up to 72 hours (the default service.jwtttl). This vulnerability is fixed in 2.3.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00317 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed vikunja (go-vikunja): 2.3.0code.vikunja.io/api (Go): 2.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
go-vikunjavikunjabefore 2.3.02.3.0Patch availableCNA
—code.vikunja.io/api (Go)before 2.3.02.3.0Patch availableGHSA-96q5-xm3p-7m84
  • vikunja Vendorgo-vikunja Affected before 2.3.0 Fixed in 2.3.0 Patch available CNA
  • code.vikunja.io/api (Go) Vendor— Affected before 2.3.0 Fixed in 2.3.0 Patch available GHSA-96q5-xm3p-7m84

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*before 2.3.0Vulnerablego-vikunja
  • cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* Versions before 2.3.0 Vulnerable ·go-vikunja

Remediation

  • Fix · CNA vikunja (go-vikunja) Fixed in 2.3.0
  • Fix · GHSA-96q5-xm3p-7m84 code.vikunja.io/api (Go) Fixed in 2.3.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35594
  2. 2026-10-03 Alias added: GHSA-96q5-xm3p-7m84

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2026-21967 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change CVSS 3.1CRITICAL 9.1
  • TI-2026-26971 Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path CVSS 3.1CRITICAL 9.1
  • TI-2026-26060 Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation CVSS 3.1HIGH 7.5
  • TI-2026-20965 Vikunja Affected by XSS Via Task Preview CVSS 4.0HIGH 8.6
  • TI-2026-27698 Vikunja Affected by Privilege Escalation via Project Reparenting CVSS 3.1HIGH 8.3
  • TI-2026-25727 Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement CVSS 3.1HIGH 8.1
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences