Medium severity4.3NVD Advisory· Published Apr 10, 2026· Updated Apr 17, 2026
CVE-2026-35596
CVE-2026-35596
Description
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any authenticated user to read any label that has at least one task association, regardless of project access. Label titles, descriptions, colors, and creator information are exposed. This vulnerability is fixed in 2.3.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
code.vikunja.io/apiGo | < 2.3.0 | 2.3.0 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/go-vikunja/vikunja/commit/fc216c38afaa51dd56dde7a97343d2148ecf24c1nvdPatchWEB
- github.com/go-vikunja/vikunja/security/advisories/GHSA-hj5c-mhh2-g7jqnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-hj5c-mhh2-g7jqghsaADVISORY
- github.com/go-vikunja/vikunja/pull/2578nvdIssue TrackingWEB
- github.com/go-vikunja/vikunja/releases/tag/v2.3.0nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.