CVE-2026-35596 go-vikunja CVE debrief

Who should care

System administrators and defenders managing Vikunja installations, especially those with sensitive labels or using earlier versions, should assess exposure and prioritize upgrading to version 2.3.0 or later.

Why it matters

CVE-2026-35596 allows authenticated users in Vikunja to read labels they should not have access to, potentially leading to information disclosure. Defenders should verify and upgrade to version 2.3.0, review user access controls, and assess label sensitivity.

• Authenticated users can access sensitive label information without proper authorization
• Potential for information disclosure through label data exposure
• Need for verification of user access controls and label sensitivity
• Upgrade to version 2.3.0 or later to mitigate the vulnerability

Technical summary

The hasAccessToLabel function in Vikunja versions prior to 2.3.0 contains a SQL operator precedence bug. This bug allows any authenticated user to read labels with at least one task association, regardless of their project access level. Exposed information includes label titles, descriptions, colors, and creator details. The vulnerability is fixed in version 2.3.0. Defenders should prioritize verifying and upgrading to Vikunja version 2.3.0 or later if using an earlier version. Authenticated user access controls and label sensitivity should be reviewed to mitigate potential information disclosure.

Defensive priority

Defenders should prioritize verifying and upgrading to Vikunja version 2.3.0 or later if using an earlier version. Authenticated user access controls and label sensitivity should be reviewed.

Recommended defensive actions

• Verify and upgrade to Vikunja version 2.3.0 or later
• Review authenticated user access controls
• Assess label sensitivity and access
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability. The fix is documented in the release notes for Vikunja version 2.3.0. Defenders should verify the vulnerability's impact on their systems, review user access controls, and assess label sensitivity. Evidence is limited to publicly available information, and further verification tasks are needed to ensure accurate exposure assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.