NIXPKGS-2026-1067

GitHub issue published on

Permalink CVE-2026-35596

4.3 MEDIUM

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): LOW
Integrity impact (I): NONE
Availability impact (A): NONE

updated 22 hours ago by @LeSuisse Activity log

Created automatic suggestion 1 day, 4 hours ago
@LeSuisse removed package vikunja-desktop 23 hours ago
@LeSuisse ignored reference https://g… 23 hours ago
@LeSuisse accepted 23 hours ago
@LeSuisse published on GitHub 22 hours ago

Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any authenticated user to read any label that has at least one task association, regardless of project access. Label titles, descriptions, colors, and creator information are exposed. This vulnerability is fixed in 2.3.0.