CVE-2026-35594 describes an insufficient session expiration vulnerability (CWE-613) in the open-source task management platform Vikunja before version 2.3.0. The link share authentication function (GetLinkShareFromClaims) relies entirely on JWT claims without validating against the server-side database. Consequently, when a project owner deletes a link share or reduces its permissions, JWTs issued prior to that change continue to grant the original access level for the duration of the JWT's TTL (default 72 hours). This flaw allows stale tokens to maintain elevated permissions temporarily. The vulnerability is addressed in Vikunja 2.3.0.

An attacker or user holding a previously issued JWT token can retain access permissions that should have been revoked due to link share deletion or permission downgrade for up to 72 hours. This could lead to unauthorized access or modification of project data during that window. The impact is limited to the duration of the JWT's time-to-live and does not allow permanent privilege escalation. The CVSS score of 6.5 reflects a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact.

Upgrade Vikunja to version 2.3.0 or later, where this vulnerability is fixed. Since the vendor advisory confirms the issue is resolved in 2.3.0, applying this official fix is the recommended remediation. There is no indication of alternative mitigations or temporary workarounds. Patch status is not explicitly stated but the fix is included in the new version release.