CVE-2026-123531 Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter

High 8.7 Published 8 Nov 2026 Updated 12 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-123531?

CVE-2026-123531 is a high-severity vulnerability in go-vikunja vikunja, published on 8 Nov 2026.

Official description

Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending page=0 to /api/v1 list endpoints. Attackers can self-register and repeatedly request page=0 to force unbounded SQL queries, memory materialisation, and per-row query fan-out, degrading availability for other users.

Weakness: CWE-400

Which versions are affected by CVE-2026-123531?

How do I fix CVE-2026-123531?

No fix has been published for CVE-2026-123531 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-123531 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-123531 exists.

Sources

Also known as GHSA-53m5-vjvm-vwjj, GHSA-v579-5fwc-gr28.