Denial of Service Vulnerability in Vikunja by Vikunja Team

CVE-2026-123519

What is CVE-2026-123519?

Vikunja prior to version 2.7.1 is susceptible to a denial of service attack that allows authenticated users to overload the API's memory resources. By submitting excessively large WeKan JSON payloads with no restrictions on item count—potentially containing hundreds of thousands of entries or duplicate IDs—malicious users can trigger out-of-memory (OOM) conditions. This exploitation can lead to the application crashing, significantly affecting service availability for legitimate users.

References