CVE-2026-123531 Details
Description
Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending page=0 to /api/v1 list endpoints. Attackers can self-register and repeatedly request page=0 to force unbounded SQL queries, memory materialisation, and per-row query fan-out, degrading availability for other users.
A vulnerability in Vikunja versions 1.0.0 prior to 2.7.1 allows authenticated users to bypass the maximum items per page limit by sending a page=0 parameter to the /api/v1 list endpoints. This flaw enables users to exploit unbounded SQL queries, excessive memory usage, and additional per-row query processing, which can degrade service availability for other users. The issue arises because the page parameter validation only rejects negative values, allowing page=0 to be interpreted as 'no pagination', thereby removing the SQL LIMIT clause from queries. As a result, the entire result set is loaded into memory and serialized into a single response, bypassing the intended cap on returned items.
Users can update to Vikunja version 2.7.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v579-5fwc-gr28 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/vikunja-1.0.0-before-2.7.1-pagination-limit-bypass-via-page-0-parameter | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vikunja | >= 1.0.0, <= 2.7.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | New CVE Received | [email protected] |