CVE-2026-35594— Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade
Quick assessment
Affected
go-vikunja vikunja
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Vikunja是Vikunja开源的一个待办事项应用程序。 Vikunja 2.3.0之前版本存在代码问题漏洞，该漏洞源于链接共享身份验证完全基于JWT声明构建授权对象，缺乏服务器端数据库验证，可能导致已删除或降权的链接共享令牌在默认有效期内仍保留原始权限。
Possible ATT&CK Techniques 1 AI
T1136 · Create Account
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-35594
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade
Source: CVE Program / CVE List V5
Vulnerability Description
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_sharing.go) constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner deletes a link share or downgrades its permissions, all previously issued JWTs continue to grant the original permission level for up to 72 hours (the default service.jwtttl). This vulnerability is fixed in 2.3.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5
Vulnerability Title
Vikunja 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Vikunja是Vikunja开源的一个待办事项应用程序。 Vikunja 2.3.0之前版本存在代码问题漏洞，该漏洞源于链接共享身份验证完全基于JWT声明构建授权对象，缺乏服务器端数据库验证，可能导致已删除或降权的链接共享令牌在默认有效期内仍保留原始权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| go-vikunja | vikunja | < 2.3.0 | - |
|
II. Public POCs for CVE-2026-35594
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-35594
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-35594 (2)
Vendor Advisories for CVE-2026-35594 (1)
Vendor Pages for CVE-2026-35594 (1)
-
Release v2.3.0 · go-vikunja/vikunja · GitHub x_refsource_MISC
Same Patch Batch · go-vikunja · 2026-04-10 · 11 CVEs total
| CVE-2026-35595 | 8.3 HIGH | Vikunja Affected by Privilege Escalation via Project Reparenting |
| CVE-2026-34727 | 7.4 HIGH | Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path |
| CVE-2026-35599 | 6.5 MEDIUM | Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler |
| CVE-2026-35597 | 5.9 MEDIUM | Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout |
| CVE-2026-35600 | 5.4 MEDIUM | Vikunja has HTML Injection via Task Titles in Overdue Email Notifications |
| CVE-2026-35602 | 5.4 MEDIUM | Vikunja has a File Size Limit Bypass via Vikunja Import |
| CVE-2026-35596 | 4.3 MEDIUM | Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug |
| CVE-2026-35598 | 4.3 MEDIUM | Vikunja has Missing Authorization on CalDAV Task Read |
| CVE-2026-40103 | 4.3 MEDIUM | Vikunja's Scoped API tokens with projects.background permission can delete project backgro |
| CVE-2026-35601 | 4.1 MEDIUM | Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output |
IV. Related Vulnerabilities
Same product: vikunja
-
CVE-2026-91984
Vikunja before 2.6.0 Broken Object-Level Authorization via t -
CVE-2026-91985
Vikunja before 2.6.0 Privilege Escalation via Link Share Has -
CVE-2026-91983
Vikunja before 2.6.0 API Token Scope Bypass via expand Param -
CVE-2026-91982
Vikunja before 2.6.0 TOTP Secret Disclosure via API -
CVE-2026-91981
Vikunja before 2.6.0 User Enumeration via v2 API
Same vendor: go-vikunja
-
CVE-2026-91984
Vikunja before 2.6.0 Broken Object-Level Authorization via t -
CVE-2026-91985
Vikunja before 2.6.0 Privilege Escalation via Link Share Has -
CVE-2026-91983
Vikunja before 2.6.0 API Token Scope Bypass via expand Param -
CVE-2026-91981
Vikunja before 2.6.0 User Enumeration via v2 API -
CVE-2026-91982
Vikunja before 2.6.0 TOTP Secret Disclosure via API
Same weakness: CWE-613
-
CVE-2026-102367
mall4j through 4.0 Insufficient Session Expiration via Token -
CVE-2026-88805
Session Not Revoked Server-Side on Logout in Rancher -
CVE-2026-100711
froxlor before 2.3.12 Authentication Bypass via Session Pers -
CVE-2026-100624
Capgo.app before 12.264.5 Upload Expiry Bypass via build upl -
CVE-2026-100554
OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass
V. Comments for CVE-2026-35594
No comments yet