Is CVE-2026-35594 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2026-35594, but active exploitation has not been confirmed.

Can CVE-2026-35594 be exploited remotely?

Yes. CVE-2026-35594 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-35594?

CVE-2026-35594 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-35594

MEDIUMPOC

CVE-2026-35594

CWE-613Published: April 10, 2026· Updated: Apr 14, 2026

6.5

CVSS v3.1

Official Description

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_sharing.go) constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner deletes a link share or downgrades its permissions, all previously issued JWTs continue to grant the original permission level for up to 72 hours (the default service.jwtttl). This vulnerability is fixed in 2.3.0.

NVD Source

Technical Analysis

CVE-2026-35594 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A proof-of-concept (PoC) exploit exists for CVE-2026-35594. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.