4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35596

CVE-2026-35596: Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any authenticated user to read any label that has at least one task association, regardless of project access. Label titles, descriptions, colors, and creator information are exposed. This vulnerability is fixed in 2.3.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35596

CVE-2026-35596:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.vikunja.io/api	go	<= 2.2.2	2.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described in the advisory GHSA-hj5c-mhh2-g7jq, is a broken access control issue caused by a SQL operator precedence bug within the hasAccessToLabel function in pkg/models/label_permissions.go. The bug originated from the way the xorm library was used to build a database query. Chaining .Where(), .Or(), and .And() methods resulted in a SQL query where conditions were not grouped as intended, allowing parts of the WHERE clause to be met unintentionally.

The provided commit fc216c38afaa51dd56dde7a97343d2148ecf24c1 directly addresses this issue within the hasAccessToLabel function. The patch refactors the query construction to use builder.And and builder.Or to create an explicitly grouped and unambiguous SQL query, thereby correcting the logic. A comment added in the patched code directly references the GHSA advisory and explains how the previous implementation was flawed. Therefore, the Label.hasAccessToLabel function is the precise location of the vulnerability.

Vulnerable functions

Label.hasAccessToLabel

pkg/models/label_permissions.go

The `hasAccessToLabel` function was vulnerable because it constructed a SQL query using chained xorm methods (`.Where`, `.Or`, `.And`) which did not enforce correct operator precedence. This resulted in a query where `WHERE A OR B OR C AND D` was interpreted as `WHERE A OR B OR (C AND D)`. The `labels.id = ?` check was only applied to one part of the OR conditions, allowing an unauthenticated user to bypass access controls and read any label associated with at least one task.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.