CVE-2026-123509

4.3 MEDIUMpublic exploit available

Published 2026-11-08 · Updated 2026-11-10

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows project writers or view admins to create unlimited kanban buckets due to missing count caps. Attackers can create thousands of buckets so every kanban read runs a task SELECT and COUNT per bucket, generating heavy database load.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weaknesses

CWE-770

Public exploit & PoC references

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-p697-wq4x-grpj

All references

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-p697-wq4x-grpj
https://www.vulncheck.com/advisories/vikunja-before-2.7.1-denial-of-service-via-unbounded-kanban-bucket-count

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2023-54404PoC
MEDIUMCVE-2025-12767
MEDIUMCVE-2025-36061
UNSCOREDCVE-2025-8352
MEDIUMCVE-2026-100274
UNSCOREDCVE-2026-100302
MEDIUMCVE-2026-100350PoC
MEDIUMCVE-2026-100508

Related by shared AI tags and CWE weakness class. Browse the full archive.