CVE-2026-35598

Katalog CVE

CVSS 4.3 · Medium EPSS 0,35%

Kerentanan Missing Authorization pada vikunja. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV GetResource and GetResourcesByList methods fetch tasks by UID from the database without verifying that the authenticated user has access to the task's project. Any authenticated CalDAV user who knows (or guesses) a task UID can read the full task data from any project on the instance. This vulnerability is fixed in 2.3.0.

Rincian

Terbit di NVD

10 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-48ch-p4gq-x46x exploit · advisory vendor
• https://github.com/go-vikunja/vikunja/commit/879462d717351fe5d276ddec5246bdec31b41661 patch
• https://github.com/go-vikunja/vikunja/pull/2579 issue tracking
• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 release notes