CVE-2026-123511

MediumCVSS 4.3/10Last modified Nov 12, 2026

Description

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated CalDAV clients to create unbounded dummy tasks by sending VTODOs with thousands of RELATED-TO properties. Attackers can repeat unknown related UIDs in a single PUT request to generate thousands of task, relation, and event rows, bloating the database and overloading the event pipeline.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Nov 8, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1235126.1Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of emailed links, so CVE-2026-1235136.8Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to swi CVE-2026-1235144.3Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned on disk after re-exp CVE-2026-1235154.1Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients reque CVE-2026-1235164.3Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consum CVE-2026-1235174.3Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exi CVE-2026-1235184.3Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's pr CVE-2026-1235196.5Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading W CVE-2026-123525.9This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device.CVE-2026-1235207.1Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or ownership of read-on CVE-2026-1235215.9Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts vulnerability that allows session holders to brut CVE-2026-1235227.1Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted