8.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35595

CVE-2026-35595: Vikunja Affected by Privilege Escalation via Project Reparenting

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/project_permissions.go:139-148 only requires CanWrite on the new parent project when changing parent_project_id. However, Vikunja's permission model uses a recursive CTE that walks up the project hierarchy to compute permissions. Moving a project under a different parent changes the permission inheritance chain. When a user has inherited Write access (from a parent project share) and reparents the child project under their own project tree, the CTE resolves their ownership of the new parent as Admin (permission level 2) on the moved project. This vulnerability is fixed in 2.3.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35595

CVE-2026-35595:

8.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.vikunja.io/api	go	<= 2.2.2	2.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a privilege escalation in Vikunja that allows a user with 'Write' access to a project to gain 'Admin' privileges. The root cause is an insufficient permission check in the Project.CanUpdate function, located in pkg/models/project_permissions.go. When a user tries to move a project to a new parent, this function only checks if the user has CanWrite permission on the new parent, which is not a high enough privilege level for such a significant change.

An attacker can exploit this by taking a project on which they have 'Write' access and reparenting it to a project that they own. Because Vikunja's permission model is recursive, the attacker inherits the 'Admin' role from their own parent project onto the moved project. This allows them to perform administrative actions like deleting the project or managing its users.

The exploit is triggered when the UpdateProject function is called, which in turn calls the vulnerable Project.CanUpdate function. The fix, seen in commit 118a0d593469a1b3b797ef1f767064abdc0113df, was to add a more stringent check directly into the UpdateProject function, requiring 'Admin' privileges for both the project being moved and the destination parent project. Therefore, both UpdateProject and Project.CanUpdate would appear in a runtime profile during exploitation.

Vulnerable functions

Project.CanUpdate

pkg/models/project_permissions.go

This function performs an insufficient permission check when a project is moved to a new parent. It only verifies if the user has 'Write' access (`CanWrite`) on the new parent project, but does not require 'Admin' privileges. This allows a user with 'Write' access to a project to reparent it under a project they own, thereby inheriting 'Admin' permissions and escalating their privileges.

UpdateProject

pkg/models/project.go

This function orchestrates the project update operation. It was vulnerable because it relied on the flawed `Project.CanUpdate` function to authorize the reparenting of a project. An attacker could trigger this function via an API call to move a project and escalate their privileges. The vulnerability was patched by adding explicit 'Admin' permission checks within this function before committing the changes.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.