Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any authenticated user to read any label that has at least one task association, regardless of project access. Label titles, descriptions, colors, and creator information are exposed. This vulnerability is fixed in 2.3.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-35596 Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any a… https://www.cve.org/CVERecord?id=CVE-2026-35596
Post summary
The snippet highlights a SQL operator precedence flaw in Vikunja’s hasAccessToLabel function (CVE‑2026‑35596), but provides no details on patches, exploits, or active use.
🚨*CVE* CVE-2026-35596 Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any a… https://www.cve.org/CVERecord?id=CVE-2026-35596 ----- Traducción: CVE-2026-35596 Vik… http://infoflow.cloud`
Post summary
The snippet describes a SQL operator precedence bug in Vikunja’s hasAccessToLabel function affecting versions before 2.3.0, but does not provide a PoC, exploit, patch, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vikunja | vikunja | - | - | - |