{"id":"CVE-2026-91968","kind":"vulnerability","aliases":["CVE-2026-91968","GHSA-xxc3-xpmc-vmvr","GO-2026-6759"],"related":[],"title":"Vikunja: Unbounded nested task-filter recursion permits API process termination in code.vikunja.io/api","description":"Vikunja: Unbounded nested task-filter recursion permits API process termination in code.vikunja.io/api.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: code.vikunja.io/api from v2.5.0 before v2.6.0.","summary":"Vikunja's Go API package accepts nested task filters with no depth limit, so recursion can exhaust the stack. An attacker who can send a crafted filter query can crash the API process.","severity":"high","cvss":7.1,"epss":0.00436,"exploited":false,"exploited_at":null,"products":[{"name":"code.vikunja.io/api","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","vikunja"],"not_affected_if":["managed-hosting","version-2.6.0-or-later"],"how_to_check":"Check whether the Go module code.vikunja.io/api is in your go.mod at a version below v2.6.0 (for example: grep code.vikunja.io/api go.mod).","fix":"Upgrade code.vikunja.io/api to v2.6.0 or later. Affected per sources: all versions before v2.6.0, with the v2.5.0 to v2.6.0 range listed explicitly.","status":"open","published_at":"2026-09-15T16:17:53+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:45:54+00:00","updated_at":"2026-10-23T21:45:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:45:54Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade code.vikunja.io/api to v2.6.0 or later. Affected per sources: all versions before v2.6.0, with the v2.5.0 to v2.6.0 range listed explicitly.","reach":"network","impact":"low","summary":"Vikunja's Go API package accepts nested task filters with no depth limit, so recursion can exhaust the stack. An attacker who can send a crafted filter query can crash the API process.","category":"package","who_cares":["go","vikunja","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker terminates the API process with a crafted nested filter request","analyst_note":"Confirm whether the filter endpoint requires login and whether the Vikunja server (not just the Go module) is the exposed component; see https://pkg.go.dev/vuln/GO-2026-6759 and https://nvd.nist.gov/vuln/detail/CVE-2026-91968.","how_to_check":"Check whether the Go module code.vikunja.io/api is in your go.mod at a version below v2.6.0 (for example: grep code.vikunja.io/api go.mod).\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting","version-2.6.0-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000533,"input_tokens":2959,"output_tokens":474,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,25A,28A '-6759':26A '-91968':18A,29A '/api':15A,32A,135C '/api.':86C 'accept':44B 'addit':95C,127C 'advisori':90C 'affect':128C 'api':9A,42B,70B,80C 'attack':59B 'automat':101C 'caus':111C 'code.vikunja.io':14A,31A,85C,134C 'code.vikunja.io/api':13A,30A,133C 'code.vikunja.io/api.':84C 'contain':94C 'could':98C 'craft':64B 'crash':68B 'cve':16A,27A 'depth':50B 'edit':122C 'exhaust':55B 'fals':113C 'false-posit':112C 'filter':6A,47B,65B,77C 'ghsa':20A 'ghsa-xxc3-xpmc-vmvr':19A 'go':24A,33B,41B,105C 'host':37B 'limit':51B 'map':102C 'modul':106C,129C 'nest':3A,45B,74C 'note':87C 'packag':34B,43B 'permit':8A,79C 'pleas':119C 'posit':114C 'process':10A,71B,81C 'queri':66B 'recurs':7A,53B,78C 'report':93C,115C,125C 'scanner':118C 'self':36B 'self-host':35B 'send':62B 'sourc':89C 'stack':57B 'standard':104C 'suggest':120C 'task':5A,46B,76C 'task-filt':4A,75C 'termin':11A,82C 'unbound':2A,73C 'v2.5.0':137C 'v2.6.0':139C 'version':96C,107C,131C 'vikunja':1A,38B,39B,72C 'vmvr':23A 'vulner':117C 'xpmc':22A 'xxc3':21A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-15T16:17:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6759","url":"https://pkg.go.dev/vuln/GO-2026-6759","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91968","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91968","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-91968","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91968","severity":null,"published_at":"2026-09-15T16:17:53+00:00","modified_at":"2026-09-16T20:16:09+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}