GO-2026-6717 Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification in code.vikunja.io/api

Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

Denial-of-service (DoS)

code.vikunja.io/api is vulnerable to a denial-of-service DoS. The vulnerability is due to missing pixel count restrictions on avatar and project-background uploads, which allows an authenticated attacker to upload crafted images with extreme aspect ratios that consume excessive CPU and memory,...

Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

Summary The 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background uploads decode uploaded images with no pixel cap. Worse, the avatar resize fixes the output height at 1024 and derives the width from the aspect ratio, so a tiny extreme-aspect-rat...

GHSA-4VH2-39RQ-RQ8J Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

Summary The 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background uploads decode uploaded images with no pixel cap. Worse, the avatar resize fixes the output height at 1024 and derives the width from the aspect ratio, so a tiny extreme-aspect-rat...

Duplicate Advisory: Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4vh2-39rq-rq8j. This link is maintained to preserve external references. Original Description Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing...

GHSA-69RJ-Q3V9-VFFP Duplicate Advisory: Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4vh2-39rq-rq8j. This link is maintained to preserve external references. Original Description Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing...

CVE-2026-91971

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and...

CVE-2026-91971

Vikunja versions before 2.6.0 are affected by a denial-of-service vulnerability in the avatar and project-background upload endpoints , where pixel decode limits are not enforced. Authenticated users can upload small images with extreme aspect ratios that decode to excessive pixel counts, consumi...

CVE-2026-91971

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and...

CVE-2026-91971: Uncontrolled Resource Consumption

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and...

SUSE CVE-2026-40103

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background, while a token with only...

CVE-2026-40103

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background, while a token with only...

CVE-2026-40103

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background, while a token with only...

CVE-2026-40103 Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background, while a token with only...

CVE-2026-40103

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background, while a token with only...

Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds

Summary Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background, while a token with only projects.backgrounddelete is rejected. This is a scoped-token authorization bypass...

GHSA-V479-VF79-MG83 Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds

Summary Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background, while a token with only projects.backgrounddelete is rejected. This is a scoped-token authorization bypass...

PT-2026-31985

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.3.0 Description Vikunja, a self-hosted task management platform, has a scoped API token enforcement issue for custom project background routes. A token with only projects.background permission can successfully delet...

SUSE CVE-2026-33312

Vikunja is an open-source self-hosted task management platform. Starting in version 0.20.2 and prior to version 2.2.0, the DELETE /api/v1/projects/:project/background endpoint checks CanRead permission instead of CanUpdate, allowing any user with read-only access to a project to permanently delet...

CVE-2026-33312

Vikunja is an open-source self-hosted task management platform. Starting in version 0.20.2 and prior to version 2.2.0, the DELETE /api/v1/projects/:project/background endpoint checks CanRead permission instead of CanUpdate, allowing any user with read-only access to a project to permanently delet...