Nil Pointer Dereference in Vikunja Affects Project Views
CVE-2026-123507

5.1MEDIUM

Key Information:

Vendor

Go-vikunja

Status
Vikunja
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123507?

The Vikunja project management platform suffers from a nil pointer dereference vulnerability that allows project admins to disrupt project views. This issue arises when a filter-mode bucket configuration is saved with a null filter. Due to the method lacking validation for nil entries, any subsequent attempts to read the project view can cause a panic in the system, leading to HTTP 500 errors for all project members. This vulnerability affects the user experience by breaking functionality in kanban boards and task collections.

Affected Version(s)

vikunja 0.24.0 < 2.7.1

vikunja 2.7.1

References

https://github.com/go-vikunja/vikunja/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/vikunja-0.24.0-befor...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.