Vulnerability · Published Apr 10, 2026 · Assigned by GitHub_M

CVE-2026-35598Vikunja has Missing Authorization on CalDAV Task Read

Medium 4.3

In plain English

A medium-severity missing authorization in vikunja from go-vikunja. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 87.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV GetResource and GetResourcesByList methods fetch tasks by UID from the database without verifying that the authenticated user has access to the task's project. Any authenticated CalDAV user who knows (or guesses) a task UID can read the full task data from any project on the instance. This vulnerability is fixed in 2.3.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	code.vikunja.io/api	2.3.0	GHSA-48ch-p4gq-x46x
Go	code.vikunja.io/api	no fix listed	GO-2026-5114

Affected products (as reported)

Vendor	Product	Versions
go-vikunja	vikunja	< 2.3.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-48ch-p4gq-x46x x_refsource_CONFIRM
https://github.com/go-vikunja/vikunja/pull/2579 x_refsource_MISC
https://github.com/go-vikunja/vikunja/commit/879462d717351fe5d276ddec5246bdec31b41661 x_refsource_MISC
https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 x_refsource_MISC