Nil pointer dereference in Vikunja breaks project views
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.
Summary
Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference (CWE-476) that lets project admins break project views. An admin who saves a filter-mode bucket configuration with a null filter causes every later read of the view to panic, so project members receive HTTP 500 responses.
Written with Claude Haiku 5.5 from the sources below · 2026-11-08
Description from the CNA
Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in kanban and task collection code, returning HTTP 500 to all project members.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| go-vikunja | vikunja | 0.24.0 to before 2.7.1 | 2.7.1 | Patch available | CNA |
- vikunja Vendorgo-vikunja Affected 0.24.0 to before 2.7.1 Fixed in 2.7.1 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* | — | — | go-vikunja |
- cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* Versions — — ·go-vikunja
Remediation
Upgrade go-vikunja vikunja to version 2.7.1 or later, which fixes the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-11-08
- Fix · CNA vikunja (go-vikunja) Fixed in 2.7.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
go-vikunja vikunja 2.7.1
39 records Highest priority Priority MEDIUM 20 MEDIUM, 19 LOW
Other records, highest priority first
- TI-2026-86673 Pagination limit bypass in Vikunja lets users exhaust resourcesPriority MEDIUM 53
- TI-2026-86654 Vikunja exposes password-reset tokens in access logsPriority MEDIUM 52
- TI-2026-86670 Insufficient session expiration in Vikunja token middlewarePriority MEDIUM 48
Timeline
- 2026-11-08 Threatist record created from CVE-2026-123507
- 2026-11-08 Alias added: GHSA-pvhp-x32p-w9mc
References
More go-vikunja vulnerabilities
- TI-2026-40929 Authorization bypass in go-vikunja Vikunja CVSS 4.0CRITICAL 9.3
- TI-2026-21967 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change CVSS 3.1CRITICAL 9.1
- TI-2026-62115 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash CVSS 4.0HIGH 8.7
- TI-2026-62108 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth CVSS 4.0HIGH 8.7
- TI-2026-62107 Vikunja before 2.6.0 Authentication Bypass via Unthrottled API CVSS 4.0HIGH 8.7
- TI-2026-26971 Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-123507 · CVE Program
- CVE-2026-123507 · NVD
- GHSA-pvhp-x32p-w9mc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences