Detections
Analytics

SCA: security update for code.vikunja.io/api (GHSA-2vq4-854f-5c72)

high Tenable Cloud Security Plugin ID 440161

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at
 pkg/models/project_permissions.go:139-148 only requires CanWrite on the new parent project when changing
 parent_project_id. However, Vikunja's permission model uses a recursive CTE that walks up the project
 hierarchy to compute permissions. Moving a project under a different parent changes the permission
 inheritance chain. When a user has inherited Write access (from a parent project share) and reparents the
 child project under their own project tree, the CTE resolves their ownership of the new parent as Admin
 (permission level 2) on the moved project. This vulnerability is fixed in 2.3.0. (CVE-2026-35595)

Solution

Update the code.vikunja.io/api library and its related packages to version 2.3.0 or later.

See Also

https://github.com/advisories/GHSA-2vq4-854f-5c72

Plugin Details

Severity: High

ID: 440161

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 4/10/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.5

Percentile: 57.5

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 8.7

Temporal Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:P

CVSS Score Source: CVE-2026-35595

CVSS v3

Risk Factor: High

Base Score: 8.3

Temporal Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/10/2026

Vulnerability Publication Date: 4/10/2026

Reference Information

CVE: CVE-2026-35595

cwe: CWE-269