Vikunja CVE-2026-91971

Requires a valid authenticated Vikunja account (CVSS PR:L) with access to either the user avatar upload endpoint or a project background image upload endpoint; on a project, the attacker needs write access to that project to set its background, while avatar upload is available to the account owner. The vulnerable code path is only reached on Vikunja releases before 2.6.0, and the attack succeeds only against uploads that the application actually decodes - i.e. image files accepted as valid avatars/backgrounds rather than rejected outright by type validation. Sustained denial of service generally requires repeated or concurrent uploads to keep resource usage elevated; a single small image is unlikely to take a large instance offline. Practical limits: no confidentiality or integrity impact is achieved, exploitation is ineffective if self-registration is disabled and accounts are not otherwise obtainable, and per-IP rate limiting, upload size restrictions or container resource limits on the reverse proxy raise the number of requests needed and reduce impact.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) describes a network-reachable, low-complexity, automatable availability attack that requires only a low-privileged authenticated account and no user interaction, and the impact is confined to availability - confidentiality and integrity across both vulnerable and subsequent systems are rated None. That profile is consistent with a reliable, low-skill DoS rather than a data-compromise issue. No CISA KEV listing and no reported POC were supplied, so exploitation is not confirmed in the wild; EPSS data was not provided, which limits the ability to quantify likelihood and should be verified separately. The main uncertainty is operational rather than technical: because the exploit depends on an attacker holding a valid account (and on self-registration being open or credentials being obtainable), the realistic risk scales with how freely accounts can be created and how aggressively upload rate limiting is configured - a defender on a closed instance with throttling has materially lower exposure than one with open registration.

An attacker registers or obtains a low-privileged Vikunja account, then uploads a small crafted image with an extreme aspect ratio to the avatar or project-background endpoint; the server decodes it into an enormous pixel buffer, spiking CPU and memory. By scripting repeated or concurrent uploads - no user interaction or elevated privilege required - the attacker holds the instance in a resource-saturated state and makes Vikunja unresponsive for legitimate users.