Unbounded kanban bucket creation in Vikunja causes denial of service
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.
Summary
Vikunja before 2.7.1 contains an uncontrolled resource consumption flaw because it does not cap the number of kanban buckets a user can create. A project writer or view admin with low privileges can create thousands of buckets over the network, so every kanban read runs a task query and a count per bucket and places heavy load on the database. The sources cite CWE-770.
Written with Claude Haiku 5.5 from the sources below · 2026-11-08
Description from the CNA
Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows project writers or view admins to create unlimited kanban buckets due to missing count caps. Attackers can create thousands of buckets so every kanban read runs a task SELECT and COUNT per bucket, generating heavy database load.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| go-vikunja | vikunja | before 2.7.1 | 2.7.1 | Patch available | CNA |
- vikunja Vendorgo-vikunja Affected before 2.7.1 Fixed in 2.7.1 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* | — | — | go-vikunja |
- cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* Versions — — ·go-vikunja
Remediation
Upgrade go-vikunja vikunja to version 2.7.1 or later, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-08
- Fix · CNA vikunja (go-vikunja) Fixed in 2.7.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
go-vikunja vikunja 2.7.1
39 records Highest priority Priority MEDIUM 20 MEDIUM, 19 LOW
Other records, highest priority first
- TI-2026-86673 Pagination limit bypass in Vikunja lets users exhaust resourcesPriority MEDIUM 53
- TI-2026-86654 Vikunja exposes password-reset tokens in access logsPriority MEDIUM 52
- TI-2026-86670 Insufficient session expiration in Vikunja token middlewarePriority MEDIUM 48
Timeline
- 2026-11-08 Threatist record created from CVE-2026-123509
- 2026-11-08 Alias added: GHSA-4865-9p8m-45gc
References
More go-vikunja vulnerabilities
- TI-2026-40929 Authorization bypass in go-vikunja Vikunja CVSS 4.0CRITICAL 9.3
- TI-2026-21967 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change CVSS 3.1CRITICAL 9.1
- TI-2026-62115 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash CVSS 4.0HIGH 8.7
- TI-2026-62108 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth CVSS 4.0HIGH 8.7
- TI-2026-62107 Vikunja before 2.6.0 Authentication Bypass via Unthrottled API CVSS 4.0HIGH 8.7
- TI-2026-26971 Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-123509 · CVE Program
- CVE-2026-123509 · NVD
- GHSA-4865-9p8m-45gc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences