Vikunja CVE-2026-91969

Exploitation requires three concrete things: (1) an authenticated Vikunja account, since the CVSS vector specifies PR:L and the endpoint is behind the API's authentication layer - instances with closed registration are exposed only to existing users; (2) the CSV migration feature/endpoint POST /api/v2/migration/csv/migrate must be reachable by that account, meaning any deployment where ordinary users can invoke migration imports, and no proxy rule blocks the path; and (3) the ability to POST a multipart CSV body large enough in row count to exhaust process memory, which implies proxy, WAF, and body-size limits must not truncate the upload before the parser runs. Limiting factors: the attacker cannot read or alter other tenants' data (VC:N/VI:N), impact is transient availability loss only, and instances that sandbox the API in a memory-capped container with automatic restart recover quickly rather than suffering host-level failure. Instances that restrict the migration endpoint to administrators, or that cap upload size at a very low threshold, are not practically exploitable by low-privileged users.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H, score 7.1) describes a low-complexity, network-reachable attack that requires only a low-privileged authenticated account and no user interaction, with impact confined to availability - confidentiality and integrity are explicitly unchanged. That combination makes the issue trivially automatable against any instance that permits self-registration or has a low-trust user base, since an attacker can register or reuse a basic account and fire a single large upload. Confidence in the CVSS-derived judgment is high because the vector is self-consistent with the description (memory exhaustion, no data disclosure). What is NOT confirmed: there is no KEV entry, no POC or exploit-code indicator in the supplied data, and no EPSS score was provided, so widespread opportunistic scanning cannot be asserted - the practical risk is likely to come from insider or low-privileged-tenant abuse rather than mass internet exploitation. The wildcard CPE also means asset inventories relying on CPE alone may over-match versions; use the 2.5.0 < 2.6.0 range from EUVD for scoping. Multi-tenancy amplifies impact: one malicious user's upload can deny service to every other user on the same instance.

An attacker with any valid low-privileged Vikunja account - obtained via open registration or a compromised/shared tenant account - sends a single multipart POST to /api/v2/migration/csv/migrate containing a CSV built from millions of minimal one-field rows. The parser accumulates parsed record objects in memory without a cardinality cap until the Go process exhausts available heap and is killed or panics, taking the API offline for every user on the instance. The attack is trivial to automate and repeat, and no user interaction or high privilege is needed.