Uncontrolled Resource Consumption in Vikunja Affects Multiple Versions

CVE-2026-123531

What is CVE-2026-123531?

Vikunja versions prior to 2.7.1 are susceptible to an uncontrolled resource consumption vulnerability. Authenticated users are able to bypass the configured pagination limit by manipulating the request to include page=0 on the /api/v1 list endpoints. This manipulation leads to unbounded SQL queries, which can severely degrade the performance and availability of the application for other users. Attackers can exploit this vulnerability by self-registering and continuously submitting requests to the affected endpoints, resulting in excessive resource usage.

References