Permission Inheritance Weakness in Vikunja Task Management Platform

CVE-2026-35595

What is CVE-2026-35595?

Vikunja, an open-source task management platform, contains a permission inheritance flaw prior to version 2.3.0. This vulnerability arises from the CanUpdate check in the permission model, which inadequately verifies permissions when a user changes the parent project for a project. The recursive permission traversal ensures that when a project is reparented, the permissions can inadvertently grant a user elevated access to the moved project. Specifically, a user inheriting Write permissions from a parent project could be escalated to Admin status upon changing the project hierarchy. This issue puts the integrity of project permissions at risk, and it is crucial for users to upgrade to version 2.3.0 where this vulnerability is addressed.

References