CVE-2026-123514

CVE-2026-123514CVE-2026-123514

Description

Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned on disk after re-exports, failed exports, or account deletion. Authenticated users can repeatedly re-trigger exports containing all their attachments to exhaust disk storage, while deleted users' personal data remains retained indefinitely.

Scoring

CVSS 4.3 ()
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Last modified2026-11-08
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.