6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35594

CVE-2026-35594: Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_sharing.go) constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner deletes a link share or downgrades its permissions, all previously issued JWTs continue to grant the original permission level for up to 72 hours (the default service.jwtttl). This vulnerability is fixed in 2.3.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35594

CVE-2026-35594:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.vikunja.io/api	go	<= 2.2.2	2.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2026-35594, exists in Vikunja's link share authentication mechanism. The root cause is the stateless nature of JWT validation for link shares. The models.GetLinkShareFromClaims function would create an authorization object based solely on the claims present in the JWT, without consulting the database to verify the current status of the link share. Consequently, if a link share was deleted or its permissions were reduced, any JWTs issued prior to this change would remain valid and grant the original level of access for their entire lifespan (up to 72 hours by default).

The patch addresses this by modifying models.GetLinkShareFromClaims to perform a database lookup. The new implementation retrieves the link share by its ID from the database and verifies that it still exists and that its hash matches the one in the JWT. This ensures that any changes, such as deletion or permission modification, are immediately reflected, effectively revoking stale tokens. The function auth.GetAuthFromClaims, which is the caller for link share authentication, was updated to facilitate this by providing a database session. Therefore, both models.GetLinkShareFromClaims and auth.GetAuthFromClaims are key functions that would appear in a runtime profile during the exploitation of this vulnerability.

Vulnerable functions

models.GetLinkShareFromClaims

pkg/models/link_sharing.go

The vulnerability lies in this function, which, before the patch, constructed a `LinkSharing` authorization object directly from JWT claims without any database validation. This meant that if a link share was deleted or its permissions were downgraded, a previously issued JWT could still be used to gain access with the original permissions until the token expired (up to 72 hours). The function trusted the claims within the JWT instead of verifying the link share's status against the database.

auth.GetAuthFromClaims

pkg/modules/auth/auth.go

This function serves as an entry point for authentication based on JWT claims. It identifies the authentication type from the token and, for link shares, it calls the vulnerable `models.GetLinkShareFromClaims` function. An exploit would trigger this function, which would then proceed with the flawed, stateless validation logic. The patch modified this function to pass a database session to `GetLinkShareFromClaims` to enable stateful validation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.