GHSA-jfw3-2gcf-23r5High· 6.5▾ TwilightDuplicate Advisory: Vikunja: Unbounded nested task-filter recursion permits API process termination
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-xxc3-xpmc-vmvr. This link is maintained to preserve external references.
vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.
code.vikunja.io/api = 2.5.0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
GO-2026-6754NoneVikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal in code.vikunja.io/api
GO-2026-6714NoneVikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api
GO-2026-6723NoneVikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint in code.vikunja.io/api
GO-2026-6732NoneVikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.viku…
CVE-2026-111917Medium· 6.5Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
CVE-2026-111918Medium· 5.4Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants