{"id":"CVE-2026-123519","kind":"vulnerability","aliases":["CVE-2026-123519"],"related":[],"title":"Vikunja: unlimited WeKan import lets logged-in users exhaust memory","description":"Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a ~22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the wekan migrate endpoint, triggering OOM and crashing the instance.","summary":"Vikunja before 2.7.1 does not cap the number of items in WeKan or vikunja-file imports. An authenticated user can upload a large WeKan JSON file to the migration endpoint, exhausting server memory and crashing the instance.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","vikunja"],"not_affected_if":["version-2.7.1-or-later"],"how_to_check":"- Check the running Vikunja version against the `2.7.1` boundary.\n- Confirm whether the WeKan or vikunja-file migration endpoints are reachable by user accounts.","fix":"- Vikunja: move to `2.7.1` or later.","status":"open","published_at":"2026-11-08T02:16:41+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","triaged_at":"2026-11-08T02:23:29+00:00","updated_at":"2026-11-08T02:23:29+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:23:29Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: move to `2.7.1` or later.","reach":"network","title":"Vikunja: unlimited WeKan import lets logged-in users exhaust memory","impact":"medium","summary":"Vikunja before 2.7.1 does not cap the number of items in WeKan or vikunja-file imports. An authenticated user can upload a large WeKan JSON file to the migration endpoint, exhausting server memory and crashing the instance.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Instance crashes from memory exhaustion, causing denial of service","analyst_note":"","how_to_check":"- Check the running Vikunja version against the `2.7.1` boundary.\n- Confirm whether the WeKan or vikunja-file migration endpoints are reachable by user accounts.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.7.1-or-later"],"who_is_affected":"Teams that run a self-hosted Vikunja instance on a version before 2.7.1 and let users import WeKan or vikunja-file data. Instances where only trusted admins can log in, or where the import feature is not used, face less exposure. unknown whether managed hosting differs.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000681,"input_tokens":4301,"output_tokens":502,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123519':14A,17A '-2026':13A,16A '2.7.1':25B,63C '22':97C 'allow':71C 'api':76C 'attack':93C 'authent':41B,72C 'cap':28B,92C 'card':106C 'contain':64C 'count':91C 'crash':58B,118C 'cve':12A,15A 'denial':66C 'duplic':108C 'endpoint':53B,114C 'exhaust':10A,54B,75C 'file':38B,49B,85C 'host':21B 'hundr':102C 'id':109C 'import':4A,39B,86C 'instanc':60B,120C 'item':32B,90C 'item-count':89C 'json':48B,100C 'larg':46B 'let':5A 'log':7A 'logged-in':6A 'mb':98C 'memori':11A,56B,78C 'migrat':52B,113C 'number':30B 'oom':116C 'packag':18B 'process':77C 'self':20B 'self-host':19B 'server':55B 'servic':68C 'submit':95C 'thousand':104C 'trigger':115C 'unlimit':2A 'upload':44B,80C 'user':9A,42B,73C 'vikunja':1A,22B,23B,37B,61C,84C 'vikunja-fil':36B,83C 'vulner':69C 'wekan':3A,34B,47B,81C,99C,112C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted Vikunja instance on a version before 2.7.1 and let users import WeKan or vikunja-file data. Instances where only trusted admins can log in, or where the import feature is not used, face less exposure. unknown whether managed hosting differs.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","vikunja"],"campaign_type":null,"search_a":"'-123519':14A,17A '-2026':13A,16A 'cve':12A,15A 'exhaust':10A 'import':4A 'let':5A 'log':7A 'logged-in':6A 'memori':11A 'unlimit':2A 'user':9A 'vikunja':1A 'wekan':3A","search_b":"'2.7.1':25B 'authent':41B 'cap':28B 'crash':58B 'endpoint':53B 'exhaust':54B 'file':38B,49B 'host':21B 'import':39B 'instanc':60B 'item':32B 'json':48B 'larg':46B 'memori':56B 'migrat':52B 'number':30B 'packag':18B 'self':20B 'self-host':19B 'server':55B 'upload':44B 'user':42B 'vikunja':22B,23B,37B 'vikunja-fil':36B 'wekan':34B,47B","search_c":"'2.7.1':63C '22':97C 'allow':71C 'api':76C 'attack':93C 'authent':72C 'cap':92C 'card':106C 'contain':64C 'count':91C 'crash':118C 'denial':66C 'duplic':108C 'endpoint':114C 'exhaust':75C 'file':85C 'hundr':102C 'id':109C 'import':86C 'instanc':120C 'item':90C 'item-count':89C 'json':100C 'mb':98C 'memori':78C 'migrat':113C 'oom':116C 'process':77C 'servic':68C 'submit':95C 'thousand':104C 'trigger':115C 'upload':80C 'user':73C 'vikunja':61C,84C 'vikunja-fil':83C 'vulner':69C 'wekan':81C,99C,112C","first_public_at":"2026-10-22T10:05:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123519","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123519","severity":null,"published_at":"2026-11-08T02:16:41+00:00","modified_at":"2026-11-08T02:16:41+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","fetched_at":"2026-11-08T02:21:09+00:00","note":null}],"documents":[{"id":99187,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-g2xc-jv9q-46wq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:05:51+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99188,"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-memory-exhaustion-dos-via-wekan-and-vikunja-file-imports","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}