What is CVE-2026-91968?

CVE-2026-91968 is a medium-severity vulnerability in Go-Vikunja Vikunja, classified under Uncontrolled Recursion. CVSS score: 6.5/10. Published 2026-09-15.

How severe is CVE-2026-91968?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Go-Vikunja Vikunja

CVE-2026-91968

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Go-vikunja Vikunja

Weakness classification (CWE)

CWE-674 — Uncontrolled Recursion

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-91968?: CVE-2026-91968 is a medium-severity vulnerability in Go-Vikunja Vikunja, classified under Uncontrolled Recursion. CVSS score: 6.5/10. Published 2026-09-15.
How severe is CVE-2026-91968?: Medium severity. CVSS v3 base score is 6.5 out of 10.