# CVE-2026-123514: Vikunja improper resource cleanup in export archives

Source: https://junglewise.ai/threats/cve-2026-123514-vikunja-before-2-7-1-contains-an-improper-resource-cleanup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-123514 · Severity: medium · CVSS 4.3 · Published 2026-11-08

Vikunja is a task and project management platform that allows users to export their data including projects, tasks, and attachments. The application fails to clean up exported archive files properly, leaving them orphaned on disk. Authenticated users can repeatedly trigger exports to exhaust disk storage, and data from deleted accounts persists indefinitely on the server.

Technologies: [Vikunja](https://junglewise.ai/threats/technologies/vikunja). Vendors: [Vikunja](https://junglewise.ai/threats/vendors/vikunja).

## Quick answers

**Is CVE-2026-123514 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123514 being exploited in the wild.

**How severe is CVE-2026-123514?** Medium severity, with a CVSS score of 4.3, published 8 November 2026.

**Which products and versions are affected?** Vikunja before 2.7.1.

**Is there a fix for CVE-2026-123514?** Yes: fixed in 2.7.1. Until then: Implement file cleanup policies to periodically remove orphaned export archives, and restrict the frequency at which users can trigger data exports to limit the rate of disk consumption. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123514 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-123514?** Check whether you run Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.7.1

Implement file cleanup policies to periodically remove orphaned export archives, and restrict the frequency at which users can trigger data exports to limit the rate of disk consumption.

## Technical details

The vulnerability stems from improper resource cleanup in the export functionality: the application overwrites the export file pointer without deleting the previous file, failed exports are not rolled back on disk, and user deletion does not remove associated export or avatar files. An authenticated attacker can trigger repeated data exports to accumulate orphaned archive files and consume available disk space, leading to potential denial of service through storage exhaustion.

## Affected products

- Vikunja Vikunja before 2.7.1

## Timeline

- 2026-10-22: disclosed
- 2026-11-08: advisory

## References

- [https://github.com/go-vikunja/vikunja/security/advisories/GHSA-7gmh-4fw6-8xc5](https://github.com/go-vikunja/vikunja/security/advisories/GHSA-7gmh-4fw6-8xc5)
- [https://www.vulncheck.com/advisories/vikunja-before-2.7.1-orphaned-export-archives-enable-disk-exhaustion](https://www.vulncheck.com/advisories/vikunja-before-2.7.1-orphaned-export-archives-enable-disk-exhaustion)

## Related threats

- [Vikunja denial of service via pagination bypass in API v1](https://junglewise.ai/threats/cve-2026-123531-vikunja-from-1-0-0-before-2-7-1-contains-an-uncontrolled)
- [Vikunja missing authentication in TOTP enrollment](https://junglewise.ai/threats/cve-2026-123530-vikunja-before-2-7-1-contains-a-missing-authentication)
- [Vikunja stored CSS injection in rich-text table cells](https://junglewise.ai/threats/cve-2026-123529-vikunja-before-2-7-1-contains-a-stored-css-injection)
- [Vikunja insufficient session expiration in HTTP token middleware](https://junglewise.ai/threats/cve-2026-123528-vikunja-before-2-7-1-contains-an-insufficient-session-expiration)
- [Vikunja API token authorization bypass in v1/v2 collision](https://junglewise.ai/threats/cve-2026-123527-vikunja-from-2-4-0-before-2-7-1-contains-an-authorization-bypass)