EUVD-2026-78646
GHSA-c2g7-39fr-cp8q
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 15, 2026
An authenticated user of Vikunja before 2.6.0 can exhaust the memory of migration worker processes by launching a Planka import job that points at a server they control, which advertises a large number of individually size-compliant attachments. Because the migrator enforces per-file size limits but no aggregate memory budget, the worker is consumed and the instance becomes unavailable to every user on it. The flaw is rated 7.1 (CVSS 4.0, availability-only impact), requires low privileges but no user interaction, and no public exploit code or CISA KEV entry is associated with it at time of analysis; the vendor has released a fix in 2.6.0.
Earlier versions of this analysis (1)
Authenticated resource exhaustion in the Vikunja task-management platform before 2.6.0 lets any logged-in user cripple the entire instance by abusing the built-in Planka migration feature. Because the migrator enforces per-file size limits but no aggregate memory budget across a migration job, an attacker who points the importer at a server they control can advertise a large number of individually compliant attachments and drive worker memory to exhaustion, denying service to every user on the instance. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N, availability-only impact), no public exploit code or in-the-wild exploitation has been identified, and the vendor has released a fix in 2.6.0.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Vikunja gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can submit migration requests pointing to attacker-controlled servers advertising numerous size-compliant attachments, exhausting worker memory and causing denial of service for all users.
Technical POC Analysis
CWE-770 (Allocation of Resources Without Limits or Throttling) in the Planka migrator of the Go module code.vikunja.io/api.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any
Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC avai
Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully cont
Stored cross-site scripting (XSS) in Vikunja prior to version 2.0.0 allows authenticated attackers to steal authenticati
Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to va
Vikunja is an open-source self-hosted task management platform. [CVSS 6.1 MEDIUM]
Business logic vulnerability in Vikunja task management platform before 2.1.0 allows incomplete resource cleanup, potent
Instance-wide data breach in Vikunja before 2.2.1 lets remote attackers exfiltrate and destroy every file attachment acr
Vikunja's OIDC callback handler issues a full JWT to any successfully matched user without checking whether that account
Vikunja instances before 2.6.0 expose CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) that are not covered b
Vikunja versions before 2.6.0 ship authentication endpoints under /api/v2 (login, register, password-reset, and OAuth to
Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint,
Exploit-DB