CVE-2026-123511 Details
Description
Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated CalDAV clients to create unbounded dummy tasks by sending VTODOs with thousands of RELATED-TO properties. Attackers can repeat unknown related UIDs in a single PUT request to generate thousands of task, relation, and event rows, bloating the database and overloading the event pipeline.
A resource exhaustion vulnerability has been identified in Vikunja versions prior to 2.7.1. This vulnerability allows authenticated CalDAV clients to create an excessive number of dummy tasks by sending VTODOs with thousands of RELATED-TO properties. Each RELATED-TO entry generates a dummy task, a task relation, and approximately two events, without any limit on the number of relations that can be processed. This unbounded task creation bloats the database and overloads the event pipeline. The vulnerability arises because the VTODO parser collects RELATED-TO properties without a cap, and repeating unknown related UIDs in a single PUT request can exponentially increase the number of created tasks and events. The dummy tasks are added to the attacker's own project, requiring a valid CalDAV login.
Users are advised to update Vikunja to version 2.7.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vikunja | <= 2.7.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | New CVE Received | [email protected] |