CVE-2026-35594 go-vikunja CVE debrief

Who should care

Defenders managing Vikunja instances, especially those using link share functionality, should assess exposure and prioritize upgrading to version 2.3.0 or implementing compensating controls.

Why it matters

CVE-2026-35594 is a medium-severity vulnerability in Vikunja's link share authentication. Defenders should prioritize verifying their inventory, assessing exposure, and ensuring upgrade to version 2.3.0 or applying compensating controls.

• Potential continued access to sensitive link shares after permission changes
• Need to verify and limit JWT token lifetime
• Possible unauthorized access to task management platform resources

Technical summary

The vulnerability in Vikunja's link share authentication constructs authorization objects from JWT claims without server-side validation. This allows JWTs issued before permission changes to remain valid for up to 72 hours, potentially granting unauthorized access to link shares. Defenders should prioritize verifying their inventory of Vikunja instances, assessing exposure to link share functionality, and ensuring upgrade to version 2.3.0 or applying compensating controls to limit JWT token lifetime. The vulnerability is fixed in version 2.3.0.

Defensive priority

Defenders should prioritize verifying their inventory of Vikunja instances, assessing exposure to link share functionality, and ensuring upgrade to version 2.3.0 or applying compensating controls to limit JWT token lifetime.

Recommended defensive actions

• Verify inventory of Vikunja instances
• Assess exposure to link share functionality
• Ensure upgrade to version 2.3.0
• Apply compensating controls to limit JWT token lifetime
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix in version 2.3.0. However, there is limited information on actual exploitation or affected deployments. Defenders should verify their inventory of Vikunja instances, assess exposure to link share functionality, and ensure upgrade to version 2.3.0 or apply compensating controls to limit JWT token lifetime. Evidence is limited to CVE and NVD details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.