CVE-2026-123507 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja is a self-hosted task and project manager. A project admin can save a filter-mode bucket configuration with a null filter, which makes every later read of that project view crash and return HTTP 500 to all project members.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted Vikunja instances from 0.24.0 before 2.7.1 where project admins can edit kanban bucket configurations. Project members are impacted when a view is broken, so teams using project views heavily should prioritize the upgrade. Instances already on 2.7.1 or later are not affected.
Not affected if single-user-instance, version-2.7.1-or-later
Who cares self-hosted, vikunja
0.24.0 before 2.7.1.2.7.1 or later, per the product range in the NVD record.Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in kanban and task collection code, returning HTTP 500 to all project members.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.