CVE-2026-123511

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated CalDAV clients to create unbounded dummy tasks by sending VTODOs with thousands of RELATED-TO properties. Attackers can repeat unknown related UIDs in a single PUT request to generate thousands of task, relation, and event rows, bloating the database and overloading the event pipeline.

Referanslar

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-c934-xjq2-mrg3
• https://www.vulncheck.com/advisories/vikunja-before-2.7.1-resource-exhaustion-via-caldav-vtodo-related-to-entries