CVE-2026-35595 affects Vikunja, an open-source task management platform, in versions before 2.3.0. The vulnerability arises from the CanUpdate permission check when changing a project's parent. The check only verifies if the user has write access on the new parent project. However, Vikunja uses a recursive common table expression (CTE) to compute permissions up the project hierarchy. When a user with inherited write access from a parent project moves a child project under their own project tree, the permission calculation incorrectly escalates their access to admin level on the moved project. This improper privilege management allows unauthorized privilege escalation. The issue is resolved in Vikunja 2.3.0.

An attacker with write access inherited from a parent project can escalate their privileges to admin on a child project by reparenting it under their own project tree. This leads to high impact on confidentiality and integrity, as the attacker gains administrative control over the project. Availability impact is low. The CVSS 3.1 score is 8.3 (high severity). There are no known exploits in the wild at this time.

Upgrade Vikunja to version 2.3.0 or later, where this vulnerability is fixed. Since the vendor advisory does not provide an official patch link or temporary workaround, applying the official update is the recommended remediation. Patch status is confirmed fixed in version 2.3.0.