Vikunja CVE-2026-35594

The CVSS 6.5 (Medium) score reflects the moderate but real-world impact: network-accessible, unauthenticated attack surface (AV:N, PR:N) with low complexity (AC:L), but limited scope (information disclosure and modification only, no system-wide impact). The EPSS exploitation probability and real-world risk are higher than the base score suggests due to the attack's passive nature and deterministic success once a token is obtained. This is not a high-CVSS-but-low-risk false alarm-the vulnerability is genuinely exploitable in common scenarios: an attacker obtaining a shared link (via phishing, accidental disclosure, or social engineering) can use it indefinitely even after the owner revokes it, creating a persistent access window. The 72-hour grace period is substantial in collaborative environments. SSVC assessment: exploitation is straightforward (deterministic token validation logic), automatable (attackers can enumerate revoked shares by testing token persistence), and the technical impact is contained (read/write to a specific project, not full system compromise). This should be prioritized for patching in production Vikunja instances, particularly those handling sensitive project data.

An attacker obtains a Vikunja link share URL (e.g., shared by a collaborator or discovered via OSINT) that grants read access to a project. The project owner later realizes the link was leaked, revokes the share via the Vikunja UI, and believes access is terminated. However, the attacker can continue using the original JWT token extracted from the link URL to access the project data for up to 72 hours, reading and modifying task information undetected. The attack requires only network access and a previously obtained link; no authentication credentials are needed, and the server performs no permission re-validation during subsequent requests.