Vikunja Package Vulnerability: Incomplete Fix for CVE-2026-35595
- Severity
- HIGH
- Affected component
- vikunja (go)
- Affected versions
- >= v2.2.2, <= v2.2.2 or >= v2.2.1, <= v2.2.1 or >= v2.2.0, <= v2.2.0 or >= v2.1.0, <= v2.1.0 or >= v2.0.0, <= v2.0.0 or >= v1.1.0, <= v1.1.0 or >= v1.0.0, <= v1.0.0 or >= v1.0.0-rc4, <= v1.0.0-rc4 or >= v1.0.0-rc3, <= v1.0.0-rc3 or >= v1.0.0-rc2, <= v1.0.0-rc2 or >= v1.0.0-rc1, <= v1.0.0-rc1 or >= v1.0.0-rc0, <= v1.0.0-rc0 or >= v0.24.1, <= v0.24.1 or >= v0.23.0, <= v0.23.0 or >= v0.22.1, <= v0.22.1 or >= v0.22.0, <= v0.22.0 or >= v0.21.0, <= v0.21.0 or >= v0.20.4, <= v0.20.4 or >= v0.20.3, <= v0.20.3 or >= v0.20.1, <= v0.20.1 or >= v0.20.0, <= v0.20.0 or >= v0.19.2, <= v0.19.2 or >= v0.19.1, <= v0.19.1 or >= v0.19.0, <= v0.19.0 or >= v0.18.1, <= v0.18.1 or >= v0.18.0, <= v0.18.0 or >= v0.17.0, <= v0.17.0 or >= v0.16.0, <= v0.16.0 or >= v0.15.0, <= v0.15.0 or >= v0.14.0, <= v0.14.0 or >= v0.13, <= v0.13 or >= v0.12, <= v0.12 or >= v0.11, <= v0.11 or >= v0.10, <= v0.10 or >= v0.9, <= v0.9 or >= v0.8, <= v0.8 or >= v0.7, <= v0.7 or >= v0.6, <= v0.6 or >= v0.5, <= v0.5 or >= v0.4, <= v0.4 or >= v0.3, <= v0.3 or >= v0.2, <= v0.2 or >= v0.1, <= v0.1
- Patched version
- 2.4.0
An early warning has been issued regarding a vulnerability in the Vikunja package. The fix for CVE-2026-35595 appears to be incomplete, allowing users with Write permission to potentially disrupt project hierarchy.
What happened
The vulnerability in question, CVE-2026-35595, pertains to an incomplete fix in the Vikunja package. The fix only gates reparent operations when `parent_project_id > 0`. However, a user with Write (but not Admin) permission can reportedly bypass the Admin requirement by setting `parent_project_id: 0`, which may lead to disruption of the project hierarchy.
This issue has been tracked under multiple IDs: CVE-2026-35595, GHSA-2VQ4-854F-5C72, and GHSA-44V6-7FXQ-VGF4. It was first flagged on 2026-08-28T16:39:08+00:00. The vulnerability has not been exploited in the wild as of the latest reports, and it is not part of a supply-chain attack.
What to do about it
- Upgrade to Vikunja version 2.4.0 to resolve the privilege escalation vulnerability.
- Review your project hierarchies and permissions to ensure they are correctly configured.
- Monitor the primary sources for any updates or additional patches.
- Consider implementing additional access controls as a temporary measure until the upgrade is performed.
How 0Day would have caught this
vikunja is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Vikunja version 2.2.2 or any earlier version, you are affected.
What should I do right now?
Upgrade to Vikunja version 2.4.0 as soon as possible.
Has this been exploited in the wild?
No, there are no reports of this vulnerability being exploited in the wild.
Sources
- [GHSA-44v6-7fxq-vgf4] Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0
- [GHSA-569v-q83c-3j3g] Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment
- [GHSA-5pg6-m483-7vrg] Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id