Is CVE-2026-35595 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35595 being exploited in the wild.

How severe is CVE-2026-35595?

High severity, with a CVSS score of 8.3, published 10 April 2026.

Which products and versions are affected?

code.vikunja.io/api (Go) <= 2.2.2, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.3.0; Vikunja <= 2.2.2.

Is there a fix for CVE-2026-35595?

Yes. code.vikunja.io/api (Go): upgrade to 2.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35595 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-35595?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35595: Vikunja privilege escalation via project reparenting

Q: Is there a fix for CVE-2026-35595?

Yes. code.vikunja.io/api (Go): upgrade to 2.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-35595 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-35595?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35595 · Severity: high · CVSS 8.3 · Published 2026-04-10

Vikunja is an open-source task management platform. A vulnerability in how it handles project organization allows a collaborator with basic 'write' access to take full administrative control over a project. By moving a shared project into their own personal folder, an attacker can lock out the original owner, delete the project and its data, or change who has access to it.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is CVE-2026-35595 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35595 being exploited in the wild.
How severe is CVE-2026-35595?: High severity, with a CVSS score of 8.3, published 10 April 2026.
Which products and versions are affected?: code.vikunja.io/api (Go) <= 2.2.2, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.3.0; Vikunja <= 2.2.2.
Is there a fix for CVE-2026-35595?: Yes. code.vikunja.io/api (Go): upgrade to 2.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35595 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-35595?: Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.vikunja.io/api (Go): upgrade to 2.3.0 or later
```
go get code.vikunja.io/api@v2.3.0
```

Technical details

A privilege escalation vulnerability exists in Vikunja due to insufficient permission checks during project reparenting. The 'CanUpdate' check in 'pkg/models/project_permissions.go' only verifies that a user has 'Write' access to a project when changing its 'parent_project_id'. Because Vikunja uses a recursive Common Table Expression (CTE) to resolve permissions based on the project hierarchy, moving a project under a parent owned by the attacker causes the system to resolve the attacker as the 'Admin' of the moved project. An authenticated attacker with write access can exploit this to gain full administrative control, allowing them to delete projects, manage shares, or remove other users. This is fixed in version 2.3.0.

Affected products

Vikunja Vikunja <= 2.2.2

Identifiers

CVE-2026-35595
GHSA-2vq4-854f-5c72
GO-2026-4952

Timeline

2026-04-09: patched: Version 2.3.0 released
2026-04-10: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.