---
id: "CVE-2026-123509"
page: "https://infrastack.ai/live/CVE-2026-123509"
kind: "vulnerability"
aliases: ["CVE-2026-123509"]
title: "Vikunja: unlimited kanban buckets let project users overload the database"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["database", "package", "self-hosted", "vikunja"]
not_affected_if: ["managed-hosting", "single-user"]
published_at: "2026-11-08T02:16:39+00:00"
first_seen_at: "2026-11-08T02:21:08+00:00"
updated_at: "2026-11-08T02:25:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123509", "first_seen_at": "2026-11-08T02:21:08+00:00"}]
exploit_sources: []
---

# Vikunja: unlimited kanban buckets let project users overload the database

Link for people: https://infrastack.ai/live/CVE-2026-123509 (this .md is for agents)

Vikunja, a self-hosted task manager, has no cap on how many kanban buckets a project can hold. A project writer or view admin can create thousands of buckets, so every kanban read runs a task query per bucket and drives heavy database load.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Vikunja version (for example `vikunja version` or the image tag) and compare it with the fixed version below.
- Review which users have project write or view admin rights on shared kanban projects.

## Fix

- Vikunja: upgrade to `2.7.1` or later (the advisory states versions before 2.7.1 are affected).

## Timeline

- 2026-11-08T02:21:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123509

## Documents

- [advisory] Vendor advisory: github.com https://github.com/go-vikunja/vikunja/security/advisories/GHSA-p697-wq4x-grpj
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vikunja-before-2.7.1-denial-of-service-via-unbounded-kanban-bucket-count

## From the sources

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows project writers or view admins to create unlimited kanban buckets due to missing count caps. Attackers can create thousands of buckets so every kanban read runs a task SELECT and COUNT per bucket, generating heavy database load.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_