PT-2026-92088

CVE-2026-91969

Published

2026-09-15

Updated

2026-10-19

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions vikunja versions prior to 2.6.0

Description A resource exhaustion issue exists where the system fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files containing millions of small records to the 'POST /api/v2/migration/csv/migrate' endpoint, leading to process memory exhaustion and termination of the API service.

Recommendations Update to version 2.6.0 or later. Restrict access to the 'POST /api/v2/migration/csv/migrate' endpoint to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

7Thparkk

Str1Ckl4Nd

Zyy0530

Vendors

Affected products

Weakness enumeration

CWE-400: Uncontrolled Resource Consumption