CVE-2026-123531
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Nov 08, 2026
Vendor
unknown
Description
Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending page=0 to /api/v1 list endpoints. Attackers can self-register and repeatedly request page=0 to force unbounded SQL queries, memory materialisation, and per-row query fan-out, degrading availability for other users.