CVE-2026-35594 describes a vulnerability in the go-vikunja vikunja task management platform where the link share authentication (GetLinkShareFromClaims) relies entirely on JWT claims without validating against the server-side database. As a result, when a project owner deletes a link share or reduces its permissions, JWT tokens issued before the change remain valid with the original permissions for the duration of the JWT time-to-live (default 72 hours). This constitutes insufficient session expiration (CWE-613). The vulnerability is fixed in version 2.3.0.

An attacker or user holding a previously issued JWT token can retain access rights that should have been revoked or reduced, potentially leading to unauthorized access to project resources for up to 72 hours after permission changes. The impact is limited to confidentiality and integrity with no direct availability impact. The CVSS score is 6.5 (medium severity).

Upgrade to Vikunja version 2.3.0 or later, where this vulnerability is fixed. Since no official patch or workaround is detailed beyond the version update, applying this upgrade is the recommended remediation. Patch status is not explicitly stated beyond the fix in 2.3.0, so verify with the vendor advisory for the latest guidance.