CVE-2026-35598

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-35598
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35598.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-35598
Aliases
Downstream
Related
Published
2026-04-10T16:04:32.083Z
Modified
2026-08-05T03:32:14.188971604Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Vikunja has Missing Authorization on CalDAV Task Read
Details

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV GetResource and GetResourcesByList methods fetch tasks by UID from the database without verifying that the authenticated user has access to the task's project. Any authenticated CalDAV user who knows (or guesses) a task UID can read the full task data from any project on the instance. This vulnerability is fixed in 2.3.0.

Database specific 
{
    "cwe_ids": [
        "CWE-862"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35598.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "2.3.0"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/go-vikunja/vikunja

Affected ranges

Type
GIT
Repo
https://github.com/go-vikunja/vikunja
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
879462d717351fe5d276ddec5246bdec31b41661
Fixed
28b537837f9808dc106c9058b5829c65759fddf2
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

v0.*
v0.1
v0.10
v0.11
v0.12
v0.13
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.18.0
v0.18.1
v0.19.0
v0.19.1
v0.19.2
v0.2
v0.20.0
v0.20.1
v0.20.3
v0.20.4
v0.21.0
v0.22.0
v0.22.1
v0.23.0
v0.24.1
v0.3
v0.4
v0.5
v0.6
v0.7
v0.8
v0.9
v1.*
v1.0.0
v1.0.0-rc0
v1.0.0-rc1
v1.0.0-rc2
v1.0.0-rc3
v1.0.0-rc4
v1.1.0
v2.*
v2.0.0
v2.1.0
v2.2.0
v2.2.1
v2.2.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35598.json"