Description
Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned on disk after re-exports, failed exports, or account deletion. Authenticated users can repeatedly re-trigger exports containing all their attachments to exhaust disk storage, while deleted users' personal data remains retained indefinitely.
Published: 2026-11-08
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Disk Exhaustion
Action: Patch Immediately
AI Analysis

Impact

The vulnerability is an improper resource cleanup that allows authenticated users to trigger repeated exports of all attachments, creating orphaned full-data archives that persist on disk indefinitely. These orphaned files can be generated after successful exports, failed exports, or even after a user's account is deleted, allowing an attacker to consume large amounts of disk space for an extended period.

Affected Systems

The affected product is Vikunja (go-vikunja:vikunja) and all releases prior to version 2.7.1. No specific patch or version list was provided beyond the boundary that the issue is fixed in 2.7.1.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, this vulnerability is not reported as being actively exploited in the wild. An authenticated attacker who can repeatedly export attachments can fill disk space, potentially leading to service disruption. Unauthenticated or deleted users are also affected because their data remains on disk, further contributing to the exhaustion.

Generated by OpenCVE AI on November 8, 2026 at 02:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Vikunja version 2.7.1 or later to resolve the improper resource cleanup bug.
  • Delete existing orphaned export archives from the server immediately to reclaim disk space.
  • Temporarily disable or restrict the export functionality for authenticated users until the patch is applied.

Generated by OpenCVE AI on November 8, 2026 at 02:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 01:45:00 +0000

Type Values Removed Values Added
Description Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned on disk after re-exports, failed exports, or account deletion. Authenticated users can repeatedly re-trigger exports containing all their attachments to exhaust disk storage, while deleted users' personal data remains retained indefinitely.
Title Vikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustion
First Time appeared Vikunja
Vikunja vikunja
Weaknesses CWE-400
CPEs cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*
Vendors & Products Vikunja
Vikunja vikunja
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Vikunja Vikunja
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-08T01:37:26.569Z

Reserved: 2026-11-06T00:46:28.480Z

Link: CVE-2026-123514

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-08T02:16:40.187

Modified: 2026-11-08T02:16:40.313

Link: CVE-2026-123514

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-08T02:30:15Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption