{"id":"CVE-2026-123509","kind":"vulnerability","aliases":["CVE-2026-123509"],"related":[],"title":"Vikunja: unlimited kanban buckets let project users overload the database","description":"Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows project writers or view admins to create unlimited kanban buckets due to missing count caps. Attackers can create thousands of buckets so every kanban read runs a task SELECT and COUNT per bucket, generating heavy database load.","summary":"Vikunja, a self-hosted task manager, has no cap on how many kanban buckets a project can hold. A project writer or view admin can create thousands of buckets, so every kanban read runs a task query per bucket and drives heavy database load.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","package","self-hosted","vikunja"],"not_affected_if":["managed-hosting","single-user"],"how_to_check":"- Check the installed Vikunja version (for example `vikunja version` or the image tag) and compare it with the fixed version below.\n- Review which users have project write or view admin rights on shared kanban projects.","fix":"- Vikunja: upgrade to `2.7.1` or later (the advisory states versions before 2.7.1 are affected).","status":"open","published_at":"2026-11-08T02:16:39+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","triaged_at":"2026-11-08T02:25:22+00:00","updated_at":"2026-11-08T02:25:22+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:25:22Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: upgrade to `2.7.1` or later (the advisory states versions before 2.7.1 are affected).","reach":"network","title":"Vikunja: unlimited kanban buckets let project users overload the database","impact":"low","summary":"Vikunja, a self-hosted task manager, has no cap on how many kanban buckets a project can hold. A project writer or view admin can create thousands of buckets, so every kanban read runs a task query per bucket and drives heavy database load.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated users degrade the database and slow kanban reads for everyone","analyst_note":"","how_to_check":"- Check the installed Vikunja version (for example `vikunja version` or the image tag) and compare it with the fixed version below.\n- Review which users have project write or view admin rights on shared kanban projects.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","single-user"],"who_is_affected":"Teams running a self-hosted Vikunja instance before 2.7.1 where users can write to or administer shared projects. Users who only have read access or who run a managed hosting service without shared project writers are less exposed. The sources do not say how much load an instance can take before it degrades.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000687,"input_tokens":4275,"output_tokens":519,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123509':13A,16A '-2026':12A,15A '2.7.1':70C 'admin':47B,83C 'allow':78C 'attack':94C 'bucket':4A,37B,52B,62B,88C,99C,111C 'cap':32B,93C 'consumpt':75C 'contain':71C 'count':92C,109C 'creat':49B,85C,96C 'cve':11A,14A 'databas':10A,17B,66B,114C 'drive':64B 'due':89C 'everi':54B,101C 'generat':112C 'heavi':65B,113C 'hold':41B 'host':21B,27B 'kanban':3A,36B,55B,87C,102C 'let':5A 'load':67B,115C 'manag':29B 'mani':35B 'miss':91C 'overload':8A 'packag':18B 'per':61B,110C 'project':6A,39B,43B,79C 'queri':60B 'read':56B,103C 'resourc':74C 'run':57B,104C 'select':107C 'self':20B,26B 'self-host':19B,25B 'task':28B,59B,106C 'thousand':50B,97C 'uncontrol':73C 'unlimit':2A,86C 'user':7A 'view':46B,82C 'vikunja':1A,22B,23B,68C 'vulner':76C 'writer':44B,80C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted Vikunja instance before 2.7.1 where users can write to or administer shared projects. Users who only have read access or who run a managed hosting service without shared project writers are less exposed. The sources do not say how much load an instance can take before it degrades.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","medium","package","selfhosted","vikunja"],"campaign_type":null,"search_a":"'-123509':13A,16A '-2026':12A,15A 'bucket':4A 'cve':11A,14A 'databas':10A 'kanban':3A 'let':5A 'overload':8A 'project':6A 'unlimit':2A 'user':7A 'vikunja':1A","search_b":"'admin':47B 'bucket':37B,52B,62B 'cap':32B 'creat':49B 'databas':17B,66B 'drive':64B 'everi':54B 'heavi':65B 'hold':41B 'host':21B,27B 'kanban':36B,55B 'load':67B 'manag':29B 'mani':35B 'packag':18B 'per':61B 'project':39B,43B 'queri':60B 'read':56B 'run':57B 'self':20B,26B 'self-host':19B,25B 'task':28B,59B 'thousand':50B 'view':46B 'vikunja':22B,23B 'writer':44B","search_c":"'2.7.1':70C 'admin':83C 'allow':78C 'attack':94C 'bucket':88C,99C,111C 'cap':93C 'consumpt':75C 'contain':71C 'count':92C,109C 'creat':85C,96C 'databas':114C 'due':89C 'everi':101C 'generat':112C 'heavi':113C 'kanban':87C,102C 'load':115C 'miss':91C 'per':110C 'project':79C 'read':103C 'resourc':74C 'run':104C 'select':107C 'task':106C 'thousand':97C 'uncontrol':73C 'unlimit':86C 'view':82C 'vikunja':68C 'vulner':76C 'writer':80C","first_public_at":"2026-10-22T10:03:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123509","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123509","severity":null,"published_at":"2026-11-08T02:16:39+00:00","modified_at":"2026-11-08T02:16:39+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","fetched_at":"2026-11-08T02:21:08+00:00","note":null}],"documents":[{"id":99167,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-p697-wq4x-grpj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:03:16+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99168,"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-denial-of-service-via-unbounded-kanban-bucket-count","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}