Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123531Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter
High 8.8
In plain English
A high-severity uncontrolled resource consumption in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending page=0 to /api/v1 list endpoints. Attackers can self-register and repeatedly request page=0 to force unbounded SQL queries, memory materialisation, and per-row query fan-out, degrading availability for other users.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 1.0.0 – before 2.7.1 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-v579-5fwc-gr28) vendor-advisory
- VulnCheck Advisory: Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter third-party-advisory