CVE-2026-35595

OVERVIEW CVE-2026-35595 is a privilege escalation vulnerability in Vikunja, an open-source self-hosted task management platform versions prior to 2.3.0. The vulnerability exists in the CanUpdate permission check function, which fails to properly validate user permissions when reassigning a project to a different parent. By exploiting the recursive permission inheritance model, an authenticated attacker with inherited write access can reparent a project in a way that grants them unintended administrative privileges on the moved project. SEVERITY The vulnerability carries a CVSS score of 8.3 (HIGH) with network-based attack vector, low complexity, and low privilege requirements. The attack requires only user authentication and no user interaction. The impact is significant, allowing attackers to achieve both high-level confidentiality and integrity compromises, with some availability impact. EPSS scoring indicates this is a relatively low-probability exploit in the wild, positioning at 0.00035. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and remains inactive on vulnerability tracking hot lists. No public exploit code is currently available, and community attention appears minimal. However, organizations running Vikunja versions prior to 2.3.0 should prioritize upgrading to mitigate this access control bypass.