CVE-2026-35594 — Insufficient Session Expiration in Vikunja

CWE-613 — Insufficient Session Expiration3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.0%
top 86.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Go-vikunja VikunjaCode.vikunja.io API
Timeline
PublishedApr 10

Description

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_sharing.go) constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner deletes a link share or downgrades its permissions, all previously issued JWTs continue to grant the original permission level for up to 72 hours (the default service.jwtttl). This vulnerability is fixed i…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 3.9 | Impact: 2.5

Affected Packages2 packages

▶CVEListV5go-vikunja/vikunja< 2.3.0

🔴Vulnerability Details

2
VulDB
go-vikunja up to 2.2.x link_sharing.go GetLinkShareFromClaims session expiration (GHSA-96q5-xm3p-7m84)↗2026-04-10
▶
GHSA
Vikunja: Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade↗2026-04-10
▶