CVE-2026-123507: Null Pointer Dereference

Published Nov 8, 2026

Updated

Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in kanban and task collection code, returning HTTP 500 to all project members.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Vikunja to a version that resolves this vulnerability.
Fixed in 2.7.1

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can trigger the denial of service?

A project administrator who can save a filter-mode bucket configuration can trigger it by supplying a null filter. The resulting failures affect every member who subsequently reads the affected project view.

Is the issue limited to a single request or view access method?

It persists in the saved project-view configuration. Subsequent reads panic in both the kanban and task collection code paths and return HTTP 500 responses.

How can I determine whether a project view has been affected?

Affected project views return HTTP 500 when members attempt to read them. The condition is associated with a saved filter-mode bucket configuration containing a null filter.

CVE-2026-123507: Null Pointer Dereference

Remediation

Event History

Frequently Asked Questions

Who can trigger the denial of service?

Is the issue limited to a single request or view access method?

How can I determine whether a project view has been affected?

Company

Resources

Contact

Frequently Asked Questions

Who can trigger the denial of service?

Is the issue limited to a single request or view access method?

How can I determine whether a project view has been affected?