Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck

CVE-2026-91971Vikunja before 2.6.0 Denial of Service via Avatar Upload

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in vikunja from go-vikunja. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 62.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and memory during processing, causing denial of service through repeated or concurrent uploads.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	code.vikunja.io/api	2.6.0	GHSA-4vh2-39rq-rq8j
Go	code.vikunja.io/api	no fix listed	GO-2026-6717

Affected products (as reported)

Vendor	Product	Versions
go-vikunja	vikunja	0 – before 2.6.0

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-4vh2-39rq-rq8j) vendor-advisory
VulnCheck Advisory: Vikunja before 2.6.0 Denial of Service via Avatar Upload third-party-advisory