Jellowbeanz26

**Name of the Vulnerable Software and Affected Versions** Vikunja versions prior to 2.6.0 **Description** Authenticated users can cause a denial of service by uploading specially crafted images to the avatar and project-background upload endpoints. The software fails to apply pixel decode limits, allowing images with extreme aspect ratios to consume excessive CPU and memory during processing. This can be triggered through repeated or concurrent uploads. **Recommendations** Update to version 2.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** Vikunja versions prior to 2.6.0 **Description** Public authentication endpoints under `/api/v2`, including login, register, password-reset, and OAuth token routes, do not implement rate limiting. This allows remote unauthenticated attackers to execute unbounded credential guessing, account enumeration, and password-reset flooding attacks without throttling restrictions. **Recommendations** Update to version 2.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** Vikunja versions prior to 2.6.0 **Description** An authentication bypass exists in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can perform unbounded credential-guessing requests against the '/dav', '/.well-known', and '/feeds' endpoints to circumvent anti-brute-force controls and compromise accounts that rely solely on passwords. **Recommendations** Update to version 2.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** Vikunja versions prior to 2.6.0 **Description** Authenticated users can cause a denial of service during data import because the system fails to limit archive expansion. An attacker can upload highly compressed files that expand to tens of gigabytes in memory and on disk, which exhausts server resources and crashes the instance. **Recommendations** Update to version 2.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** Vikunja versions prior to 2.6.0 **Description** Authenticated attackers can insert task position rows into project views belonging to other tenants. This occurs because the application fails to validate that the user-supplied `project view id` in task-position requests belongs to the project associated with the task. The issue affects the POST and PUT task-position endpoints. **Recommendations** Update to version 2.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** Vikunja versions prior to 2.6.0 **Description** Insufficient access restriction to the link-share hash field in single-share read endpoints allows read-only members to obtain the secret credential of a share. An attacker can use this disclosed hash to obtain a link-share JWT (JSON Web Token), which is a compact, URL-safe means of representing claims to be transferred between two parties. This allows the attacker to escalate privileges and perform unauthorized administrative actions or writes. **Recommendations** Update to version 2.6.0 or later.