CVE-2026-123514
Deferred Deferred - Pending Action

Improper Resource Cleanup in Vikunja Leads to Disk Exhaustion

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned on disk after re-exports, failed exports, or account deletion. Authenticated users can repeatedly re-trigger exports containing all their attachments to exhaust disk storage, while deleted users' personal data remains retained indefinitely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123514
EUVD
EUVD-2026-119399

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja vikunja to 2.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Vikunja before 2.7.1 has an improper resource cleanup flaw where export archives are left orphaned on disk after re-exports, failed exports, or account deletion. Authenticated users can repeatedly trigger exports containing all attachments, consuming disk space. Deleted users' personal data also remains retained indefinitely.

Detection Guidance
  • Check for unusually large or growing export archive directories in Vikunja's configured storage path. Look for files matching patterns like export_*.zip or similar in the export directory.
  • Use disk usage commands like 'du -sh /path/to/vikunja/exports' to monitor storage growth over time.
  • Search for orphaned user-specific export files in the storage directory, especially after account deletions or failed exports.
  • Monitor system logs for repeated export requests from the same user account, which may indicate exploitation attempts.
Impact Analysis

This vulnerability can lead to disk storage exhaustion due to orphaned export archives and attachments. Authenticated users may cause system outages by repeatedly triggering exports. Deleted user data remains accessible, posing privacy risks.

Compliance Impact

This vulnerability likely violates GDPR's data retention and deletion requirements (Article 5) and HIPAA's access control and integrity rules. Retained personal data after account deletion conflicts with 'right to erasure' and 'minimum necessary' principles.

Mitigation Strategies
  • Upgrade Vikunja to version 2.7.1 or later to apply the official fix for proper resource cleanup.
  • Manually delete all orphaned export archives from the storage directory to free up disk space.
  • Review and clean up any remaining user data from deleted accounts that may still exist in export archives.
  • Implement monitoring for export directory growth and set up alerts for abnormal storage usage patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123514. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...