Resource Exhaustion Vulnerability in Vikunja by Go Vikunja
CVE-2026-91969

7.1HIGH

Key Information:

Vendor

Go-vikunja

Status
Vikunja
Vendor
CVE Published:
15 September 2026

What is CVE-2026-91969?

Vikunja versions prior to 2.6.0 are susceptible to a resource exhaustion vulnerability via the POST /api/v2/migration/csv/migrate endpoint. This flaw allows authenticated attackers to upload multipart CSV files containing a huge number of tiny records, leading to excessive memory consumption and potential termination of the API service. This vulnerability underscores the importance of implementing strict validation and limits on input data to prevent such resource-depleting attacks.

Affected Version(s)

vikunja 2.5.0 < 2.6.0

vikunja 2.6.0

References

https://github.com/go-vikunja/vikunja/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/vikunja-before-2.6.0...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zyy0530
Str1ckl4nd
7thParkk
.