GHSA-55p4-8j34-jv53High· 6.5▾ TwilightDuplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-pqf9-h8g4-8gmh. This link is maintained to preserve external references.
vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the API service.
code.vikunja.io/api = 2.5.0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
GHSA-69rj-q3v9-vffpHigh· 6.5Duplicate Advisory: Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification
GO-2026-6754NoneVikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal in code.vikunja.io/api
GO-2026-6714NoneVikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api
GO-2026-6723NoneVikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint in code.vikunja.io/api
GO-2026-6732NoneVikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.viku…
CVE-2026-111917Medium· 6.5Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes