CVE-2026-123531 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja, a self-hosted task manager, lets any logged-in user skip its per-page item limit by sending page=0 to its list API endpoints. Repeated requests force huge database queries and memory use, slowing the service down for other users.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running a self-hosted Vikunja instance from 1.0.0 before 2.7.1 are exposed, especially where anyone can self-register. Hosted or managed Vikunja services are the vendor's responsibility, and instances already on 2.7.1 or later are not affected.
Not affected if 2.7.1-or-later, auth-required, managed-hosting
Who cares self-hosted, vikunja
vikunja version or the About page; affected releases are from 1.0.0 before 2.7.1.service.enableregistration).2.7.1 or later.Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending page=0 to /api/v1 list endpoints. Attackers can self-register and repeatedly request page=0 to force unbounded SQL queries, memory materialisation, and per-row query fan-out, degrading availability for other users.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.