CVE-2026-123519

EUVD-2026-119404
Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a ~22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the wekan migrate endpoint, triggering OOM and crashing the instance.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 23.63%
Common Weakness Enumeration
References
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-g2xc-jv9q-46wq
https://www.vulncheck.com/advisories/vikunja-before-2.7.1-memory-exhaustion-dos-via-wekan-and-vikunja-file-imports