Uncontrolled Resource Consumption Flaw in Vikunja Affects Project Management

CVE-2026-123509

What is CVE-2026-123509?

Vikunja prior to version 2.7.1 is susceptible to an uncontrolled resource consumption vulnerability, enabling users with project writer or view admin permissions to generate an excessive number of kanban buckets. The absence of limits on bucket counts allows attackers to create thousands of these buckets. Each read operation on a kanban requires a task SELECT and COUNT for every bucket created, resulting in significant strain on the database system.

References