Quick answers
- Is CVE-2026-123514 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-123514 being exploited in the wild.
- How severe is CVE-2026-123514?
- Medium severity, with a CVSS score of 4.3, published 8 November 2026.
- Which products and versions are affected?
- Vikunja before 2.7.1.
- Is there a fix for CVE-2026-123514?
- Yes: fixed in 2.7.1. Until then: Implement file cleanup policies to periodically remove orphaned export archives, and restrict the frequency at which users can trigger data exports to limit the rate of disk consumption. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-123514 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-123514?
- Check whether you run Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 2.7.1
Implement file cleanup policies to periodically remove orphaned export archives, and restrict the frequency at which users can trigger data exports to limit the rate of disk consumption.
Technical details
The vulnerability stems from improper resource cleanup in the export functionality: the application overwrites the export file pointer without deleting the previous file, failed exports are not rolled back on disk, and user deletion does not remove associated export or avatar files. An authenticated attacker can trigger repeated data exports to accumulate orphaned archive files and consume available disk space, leading to potential denial of service through storage exhaustion.
Affected products
- Vikunja Vikunja before 2.7.1
Timeline
- 2026-10-22: disclosed
- 2026-11-08: advisory