Medium severity · published Sep 15, 2026
CVE-2026-91969
vikunja before 2.6.0 Resource Exhaustion via CSV Migration
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the API service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
vikunja · go-vikunja
2.5.0 before 2.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-91969
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-91969
github.com
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pqf9-h8g4-8gmh
www.vulncheck.com
https://www.vulncheck.com/advisories/vikunja-before-2.6.0-resource-exhaustion-via-csv-migration
More from vikunja
9.8
CVE-2026-28268
Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse
9.6
CVE-2026-33334
Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration
9.1
CVE-2026-34727
Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path
9.1
CVE-2026-27575
Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change
8.8
CVE-2026-33336
Vikunja Desktop vulnerable to Remote Code Execution via same-window navigation