Resource Exhaustion Vulnerability in Vikunja Versions Before 2.6.0
CVE-2026-91970

7.1HIGH

Key Information:

Vendor

Go-vikunja

Status
Vikunja
Vendor
CVE Published:
15 September 2026

What is CVE-2026-91970?

Versions of Vikunja before 2.6.0 are susceptible to a resource exhaustion flaw in the Planka migrator. This vulnerability allows authenticated attackers to initiate migration jobs targeting maliciously configured servers that provide a multitude of size-compliant attachments. As a result, the process can deplete the available memory for worker processes, leading to denial-of-service conditions that affect all users.

Affected Version(s)

vikunja 0 < 2.6.0

vikunja 2.6.0

References

https://github.com/go-vikunja/vikunja/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/vikunja-before-2.6.0...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zyy0530
Str1ckl4nd
7thParkk
.