CVE-2026-123514

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.7.1

Description An improper resource cleanup issue allows full-data export archives to remain orphaned on the disk following failed exports, re-exports, or the deletion of an account. Authenticated users can exploit this by repeatedly triggering exports that include all attachments to exhaust available disk storage. Additionally, personal data from deleted users is retained indefinitely on the system.

Recommendations Update to version 2.7.1.