CVE-2026-123511
Deferred Deferred - Pending Action

Vikunja Uncontrolled Resource Consumption via Malicious VTODOs

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated CalDAV clients to create unbounded dummy tasks by sending VTODOs with thousands of RELATED-TO properties. Attackers can repeat unknown related UIDs in a single PUT request to generate thousands of task, relation, and event rows, bloating the database and overloading the event pipeline.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123511
EUVD
EUVD-2026-119396

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja vikunja to 2.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Vikunja before 2.7.1 allows authenticated CalDAV clients to create excessive dummy tasks by sending VTODOs with thousands of RELATED-TO properties. Attackers can repeat unknown related UIDs in a single PUT request to generate thousands of task, relation, and event rows, bloating the database and overloading the event pipeline.

Detection Guidance

Monitor for unusual spikes in database size or event pipeline load, particularly after CalDAV PUT requests. Check for excessive task and relation entries in the Vikunja database. Look for repeated unknown UIDs in VTODO RELATED-TO properties in CalDAV logs.

Impact Analysis

An attacker with valid CalDAV credentials could fill their project with dummy tasks, causing database bloat and overloading the event pipeline. This may lead to degraded performance, system slowdowns, or potential denial of service for legitimate users.

Mitigation Strategies

Upgrade Vikunja to version 2.7.1 or later to apply the fix. Implement rate limiting on CalDAV PUT requests. Monitor and limit the number of RELATED-TO properties processed per request. Review and restrict CalDAV access to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123511. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...