CVE-2026-123507 Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter

Medium 5.1 Published 8 Nov 2026 Updated 12 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-123507?

CVE-2026-123507 is a medium-severity vulnerability in go-vikunja vikunja, published on 8 Nov 2026.

Official description

Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in kanban and task collection code, returning HTTP 500 to all project members.

Weakness: CWE-476

Which versions are affected by CVE-2026-123507?

How do I fix CVE-2026-123507?

No fix has been published for CVE-2026-123507 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-123507 being exploited?

There is no known exploitation of CVE-2026-123507 in the wild and no public exploit code.

Sources

Also known as GHSA-hm4w-h7v8-ch43, GHSA-pvhp-x32p-w9mc.