Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports
Vikunja 2.7.0 and earlier are affected, because the WeKan and vikunja-file import routes are always registered with no config flag. The fix is in 2.7.1.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 2.7.1
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affects Vikunja versions 2.7.0 and earlier, before the 2.7.1 fix. The WeKan or vikunja-file import migration routes must be available.
- Published
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 15/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a ~22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the wekan migrate endpoint, triggering OOM and crashing the instance.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.1/10CVSS 7.1
- No patch0/5No signal
What would change the score
- Would score about 65 if added to CISA KEV
- Would score about 60 if CISA's SSVC rates exploitation active
- Would score about 22 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Affects Vikunja versions 2.7.0 and earlier, before the 2.7.1 fix. The WeKan or vikunja-file import migration routes must be available.Upgrade to a fixed version: 2.7.1.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- go-vikunja vikunja
fixed in 2.7.1
Evidence 2
- Advisory
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-123519
Is CVE-2026-123519 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
An authenticated user can exhaust the API process memory through the WeKan and vikunja-file import routes. This causes out-of-memory crashes and a denial of service for the whole instance.Source: github.com, vulncheck.com
Which versions are affected by CVE-2026-123519?
vikunja: before 2.7.1.Source: cve.now feed data
Am I affected, and how do I check?
Vikunja versions 2.7.0 and earlier, before the 2.7.1 fix, are affected. The WeKan and vikunja-file import routes are always registered and have no config flag to disable them, so the version in use is the main thing to compare against 2.7.1.Source: github.com, vulncheck.com
How do I fix CVE-2026-123519?
Upgrade Vikunja to 2.7.1 or later. No workaround is listed in the checked facts.Source: github.com, vulncheck.com