CVE-2026-35598
Vikunja has Missing Authorization on CalDAV Task Read
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
7th
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV GetResource and GetResourcesByList methods fetch tasks by UID from the database without verifying that the authenticated user has access to the task's project. Any authenticated CalDAV user who knows (or guesses) a task UID can read the full task data from any project on the instance. This vulnerability is fixed in 2.3.0.
| CWE | CWE-862 |
| Vendor | go-vikunja |
| Product | vikunja |
| Published | Apr 10, 2026 |
| Last Updated | Apr 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for go-vikunja vikunja
Be the first to know when new medium vulnerabilities affecting go-vikunja vikunja are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
go-vikunja / vikunja
< 2.3.0
References
github.com: https://github.com/go-vikunja/vikunja/security/advisories/GHSA-48ch-p4gq-x46x github.com: https://github.com/go-vikunja/vikunja/pull/2579 github.com: https://github.com/go-vikunja/vikunja/commit/879462d717351fe5d276ddec5246bdec31b41661 github.com: https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0