CVE-2026-123514 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja leaves full-data export archives on disk after re-exports, failed exports, or account deletion. An authenticated user can repeatedly trigger exports to fill disk storage, and deleted users' personal data stays on the server indefinitely.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted or managed Vikunja servers running a version before 2.7.1 where users can request full data exports. Exposure needs a logged-in account; instances with exports disabled or with no user accounts are less exposed. unknown whether the sources name a specific export setting.
Not affected if auth-required, fixed-version
Who cares disk-storage, personal-data, self-hosted, vikunja
2.7.1.2.7.1 or later.Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned on disk after re-exports, failed exports, or account deletion. Authenticated users can repeatedly re-trigger exports containing all their attachments to exhaust disk storage, while deleted users' personal data remains retained indefinitely.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.