CVE-2026-35596 | go-vikunja up to 2.2.x hasAccessToLabel Label titles/descriptions/colors/creator authorization (GHSA-hj5c-mhh2-g7jq)

A vulnerability was found in go-vikunja vikunja up to 2.2.x. It has been declared as problematic. Affected by this issue is the function hasAccessToLabel. Such manipulation of the argument Label titles/descriptions/colors/creator leads to incorrect authorization.

This vulnerability is uniquely identified as CVE-2026-35596. The attack can be launched remotely. No exploit exists.

It is recommended to upgrade the affected component.