What is CVE-2026-123509?

CVE-2026-123509 is a medium-severity vulnerability in Go-Vikunja Vikunja, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 4.3/10. Published 2026-11-08.

How severe is CVE-2026-123509?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Resource exhaustion in Go-Vikunja Vikunja

CVE-2026-123509

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows project writers or view admins to create unlimited kanban buckets due to missing count caps. Attackers can create thousands of buckets so every kanban read runs a task SELECT and COUNT per bucket, generating heavy database load.

Published 2026-11-08 · last modified 2026-11-08.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Go-Vikunja Vikunja

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

References

GitHub Security Advisory (GHSA-p697-wq4x-grpj) (vendor-advisory)
VulnCheck Advisory: Vikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket Count (third-party-advisory)

Frequently asked questions

What is CVE-2026-123509?: CVE-2026-123509 is a medium-severity vulnerability in Go-Vikunja Vikunja, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 4.3/10. Published 2026-11-08.
How severe is CVE-2026-123509?: Medium severity. CVSS v3 base score is 4.3 out of 10.