Is CVE-2026-123519 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123519 being exploited in the wild.

How severe is CVE-2026-123519?

Medium severity, with a CVSS score of 6.5, published 8 November 2026.

Which products and versions are affected?

Go-Vikunja Vikunja before 2.7.1.

How is CVE-2026-123519 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-123519?

Check whether you run Go-Vikunja Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123519: Vikunja denial of service in WeKan import

CVE-2026-123519 · Severity: medium · CVSS 6.5 · Published 2026-11-08

Vikunja is a web-based task management and project planning application. An authenticated user can upload a crafted WeKan or vikunja-file import containing hundreds of thousands of items, causing the API process to run out of memory and crash, rendering the service unavailable to all users.

Vendors: Go-Vikunja.

Quick answers

Is CVE-2026-123519 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123519 being exploited in the wild.
How severe is CVE-2026-123519?: Medium severity, with a CVSS score of 6.5, published 8 November 2026.
Which products and versions are affected?: Go-Vikunja Vikunja before 2.7.1.
Is there a fix for CVE-2026-123519?: Yes: fixed in 2.7.1. Until then: Restrict access to the migration endpoints (/api/v1/migration/wekan/migrate) to trusted users, or disable file-based imports if not required. Implement a reverse proxy to limit request body size and rate-limit import requests per user. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123519 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-123519?: Check whether you run Go-Vikunja Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.7.1

Restrict access to the migration endpoints (/api/v1/migration/wekan/migrate) to trusted users, or disable file-based imports if not required. Implement a reverse proxy to limit request body size and rate-limit import requests per user.

Technical details

The WeKan file-import endpoint and vikunja-file migrator decode uploaded JSON with no cap on the number of items, allowing a single large JSON file to materialize hundreds of thousands of task objects in memory simultaneously. An authenticated user can exploit this by uploading a ~22 MB JSON containing 630,000+ minimal cards, or by using duplicate IDs to trigger a cross-product amplification effect. The vulnerability stems from missing cardinality validation in the parseWekanJSON and data.json decoding paths, combined with unbounded in-process database bulk insertion.

Affected products

go-vikunja Vikunja before 2.7.1

Timeline

2026-10-22: disclosed
2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.