Dashboard / CVE-2026-35596

CVE-2026-35596

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 59/100
Published: 2026-04-10 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: Low
I: None
A: None

Description

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any authenticated user to read any label that has at least one task association, regardless of project access. Label titles, descriptions, colors, and creator information are exposed. This vulnerability is fixed in 2.3.0.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
vikunja vikunja < 2.3.0

References & Advisories (4)

Bug Bounty Relevance

59 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

4.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS — Exploitation Probability

0.27%
Raw Score 0.002720
Percentile 19.5%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00272
2026-10-28
0.00272

Intelligence Sources

nvd ref →

External Links