CVE-2026-35598: Vikunja Missing Authorization on CalDAV Task Read
The CalDAV GetResource and GetResourcesByList methods fetch tasks by UID from the database without verifying that the authenticated user has access to the task’s project. Any authenticated CalDAV user who knows (or guesses) a task UID can read the full task data from any project on the instance.
References
- github.com/advisories/GHSA-48ch-p4gq-x46x
- github.com/go-vikunja/vikunja
- github.com/go-vikunja/vikunja/commit/879462d717351fe5d276ddec5246bdec31b41661
- github.com/go-vikunja/vikunja/pull/2579
- github.com/go-vikunja/vikunja/releases/tag/v2.3.0
- github.com/go-vikunja/vikunja/security/advisories/GHSA-48ch-p4gq-x46x
- nvd.nist.gov/vuln/detail/CVE-2026-35598
Code Behaviors & Features
Detect and mitigate CVE-2026-35598 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →