CVE-2026-123519

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.7.1

Description Authenticated users can cause a denial of service by exhausting API process memory during the upload of WeKan or vikunja-file imports due to the absence of an item-count cap. By submitting a WeKan JSON file of approximately 22 MB containing duplicate IDs or hundreds of thousands of cards to the 'wekan migrate' endpoint, an attacker can trigger an Out of Memory (OOM) condition, which crashes the instance.

Recommendations Update to version 2.7.1 or later.