CVE-2026-123523

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.7.1

Description Authenticated users can cause uncontrolled resource consumption by requesting avatars in numerous distinct sizes. By uploading a noisy avatar and requesting it at every size up to 1024, an attacker can cache approximately one gigabyte of data per account without eviction. This leads to the API process being OOM-killed, which occurs when the operating system terminates a process because the system has run out of available memory.

Recommendations Update to version 2.7.1.