Description
Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending page=0 to /api/v1 list endpoints. Attackers can self-register and repeatedly request page=0 to force unbounded SQL queries, memory materialisation, and per-row query fan-out, degrading availability for other users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-vikunja | vikunja | 1.0.0 – < 2.7.1 | 2.7.1 |
References
- GitHub Security Advisory (GHSA-v579-5fwc-gr28) vendor-advisory
- VulnCheck Advisory: Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter third-party-advisory