Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123507Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter
Low 2.7
In plain English
A low-severity null pointer dereference in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in kanban and task collection code, returning HTTP 500 to all project members.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 0.24.0 – before 2.7.1 |
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
References
- GitHub Security Advisory (GHSA-hm4w-h7v8-ch43) vendor-advisory
- VulnCheck Advisory: Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter third-party-advisory