Vikunja Package Vulnerability: Incomplete Fix for CVE-2026-35595
- Severity
- HIGH
- Affected component
- go-vikunja/vikunja (go)
- Affected versions
- >= v2.2.2, <= v2.2.2 or >= v2.2.1, <= v2.2.1 or >= v2.2.0, <= v2.2.0 or >= v2.1.0, <= v2.1.0 or >= v2.0.0, <= v2.0.0 or >= v1.1.0, <= v1.1.0 or >= v1.0.0, <= v1.0.0 or >= v1.0.0-rc4, <= v1.0.0-rc4 or >= v1.0.0-rc3, <= v1.0.0-rc3 or >= v1.0.0-rc2, <= v1.0.0-rc2 or >= v1.0.0-rc1, <= v1.0.0-rc1 or >= v1.0.0-rc0, <= v1.0.0-rc0 or >= v0.24.1, <= v0.24.1 or >= v0.23.0, <= v0.23.0 or >= v0.22.1, <= v0.22.1 or >= v0.22.0, <= v0.22.0 or >= v0.21.0, <= v0.21.0 or >= v0.20.4, <= v0.20.4 or >= v0.20.3, <= v0.20.3 or >= v0.20.1, <= v0.20.1 or >= v0.20.0, <= v0.20.0 or >= v0.19.2, <= v0.19.2 or >= v0.19.1, <= v0.19.1 or >= v0.19.0, <= v0.19.0 or >= v0.18.1, <= v0.18.1 or >= v0.18.0, <= v0.18.0 or >= v0.17.0, <= v0.17.0 or >= v0.16.0, <= v0.16.0 or >= v0.15.0, <= v0.15.0 or >= v0.14.0, <= v0.14.0 or >= v0.13, <= v0.13 or >= v0.12, <= v0.12 or >= v0.11, <= v0.11 or >= v0.10, <= v0.10 or >= v0.9, <= v0.9 or >= v0.8, <= v0.8 or >= v0.7, <= v0.7 or >= v0.6, <= v0.6 or >= v0.5, <= v0.5 or >= v0.4, <= v0.4 or >= v0.3, <= v0.3 or >= v0.2, <= v0.2 or >= v0.1, <= v0.1
- Patched version
- 2.4.0
An incomplete fix for CVE-2026-35595 in the Vikunja package allows users with Write permission to bypass Admin requirements, potentially disrupting project hierarchy.
What happened
An early warning has been issued regarding a vulnerability in the Vikunja package. The fix for CVE-2026-35595 only gates reparent operations when `parent_project_id > 0`. This oversight allows a user with Write permission to bypass the Admin requirement by setting `parent_project_id: 0`, which can detach a shared project from its parent hierarchy. This issue affects all versions of the Vikunja package from v0.1 to v2.2.2.
The vulnerability has not been exploited in the wild as of the latest reports. However, it is crucial for users to assess their exposure and take necessary actions to mitigate potential risks.
What to do about it
- Upgrade to version 2.4.0 of the Vikunja package to mitigate the privilege escalation vulnerability.
- Review your project hierarchies to ensure they have not been tampered with.
- Monitor the primary sources for updates on the vulnerability and any additional mitigation steps that may be recommended.
How 0Day would have caught this
go-vikunja/vikunja is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using any version of the Vikunja package from v0.1 to v2.2.2, you are potentially affected by this vulnerability.
What should I do right now?
Upgrade to version 2.4.0 of the Vikunja package immediately to mitigate the risk.
Has this vulnerability been exploited in the wild?
No, there are no reports of this vulnerability being exploited in the wild as of the latest information.