CVE-2026-123531

Summary

Authenticated users in Vikunja versions before 2.7.1 can bypass the service.maxitemsperpage limit by sending page=0 to /api/v1 list endpoints, triggering uncontrolled SQL query execution and memory consumption. This allows resource exhaustion via repeated requests, degrading service availability for other users.

Exploitability

Authenticated attackers with self-registration capability can exploit this trivially by issuing repeated HTTP requests with page=0 to paginated list endpoints.

Blast radius

Successful exploitation can cause significant performance degradation or denial of service across the entire Vikunja instance, affecting all users and potentially cascading to dependent services.

Detection

Defenders should monitor for repeated HTTP 200 responses from /api/v1/* endpoints with unusually high response sizes or durations, especially when accompanied by page=0 query parameters in logs; elevated database CPU/memory usage correlated with authenticated user sessions may also indicate exploitation.

Prioritized remediation

Upgrade to Vikunja 2.7.1 or later, which fixes the uncontrolled resource consumption vulnerability by properly handling page=0 requests.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.