CVE-2026-123511: Security vulnerability

Published Nov 8, 2026

Updated

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated CalDAV clients to create unbounded dummy tasks by sending VTODOs with thousands of RELATED-TO properties. Attackers can repeat unknown related UIDs in a single PUT request to generate thousands of task, relation, and event rows, bloating the database and overloading the event pipeline.

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated CalDAV client can exploit it. The attack is performed by sending a VTODO through a CalDAV PUT request.

What input is required to trigger the resource consumption?

The VTODO must contain thousands of RELATED-TO properties using unknown related UIDs. Repeating unknown UIDs in one PUT request can create thousands of task, relation, and event records.

How can I tell whether an instance may have been affected?

Look for unusually large numbers of dummy tasks, relation rows, and event rows associated with CalDAV VTODO imports or PUT requests. Database growth and event-pipeline overload are indicators of exploitation.

CVE-2026-123511: Security vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

What input is required to trigger the resource consumption?

How can I tell whether an instance may have been affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What input is required to trigger the resource consumption?

How can I tell whether an instance may have been affected?