CVE-2026-91969

Executive Summary

CVE-2026-91969 is a resource exhaustion (uncontrolled resource consumption) vulnerability in Vikunja before version 2.6.0, affecting the CSV migration endpoint POST /api/v2/migration/csv/migrate. An authenticated attacker can upload a multipart CSV file containing millions of tiny records, causing the server to parse unbounded row cardinality and exhaust process memory, terminating the API service. Because the flaw requires only a low-privileged authenticated account and network access (CVSS 6.5), it represents a moderate-severity availability risk primarily to multi-tenant or internet-exposed Vikunja deployments.

Technical Analysis

The vulnerability class is CWE-400, Uncontrolled Resource Consumption. Per the NVD description, versions of Vikunja prior to 2.6.0 expose a migration import feature at POST /api/v2/migration/csv/migrate that accepts multipart CSV uploads. The endpoint parses uploaded CSV content but "fails to limit parsed row cardinality." This means no upper bound (row count, total parsed records, or equivalent cap) is enforced before or during parsing of the CSV payload.

The attack surface is an authenticated API endpoint. Because it is a migration/import function, it is designed to accept attacker-supplied file content and iterate over records, making it a natural point of memory amplification: a comparatively small upload (little more than a delimiter character per record) expands into a very large in-memory structure during parsing. When an attacker submits "millions of tiny records," each record forces allocation/processing proportional to record count rather than file size, driving the API process toward memory exhaustion and eventual termination.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H is consistent with this mechanism: network reachable (AV:N), no special conditions (AC:L), requires an authenticated low-privilege account (PR:L), no user interaction (UI:N), scope unchanged (S:U), no confidentiality or integrity impact (C:N/I:N), and high availability impact (A:H) resulting from service termination.

No public proof-of-concept, Nuclei template, or exploit code was identified in the provided intelligence. No specific internal function names, parser library, or memory-management implementation details are available from the description, and this report does not invent them. The relevant technical facts are limited to: endpoint path, HTTP method, multipart CSV upload format, the absence of a row-cardinality limit, and the resulting memory exhaustion and API process termination.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred at the vulnerability-class level from the NVD description.

1. Reconnaissance / target identification. The attacker identifies an internet- or internally-exposed Vikunja instance running a version prior to 2.6.0. Vikunja is a self-hosted task-management application whose web UI and API are often directly accessible. The attacker confirms reachability of the API base path and the presence of the CSV migration endpoint.

2. Authentication. The attacker obtains or is provisioned a valid low-privileged account. Per CVSS (PR:L), no administrative role is required — any authenticated user able to reach the migration endpoint satisfies the precondition.

3. Triggering the flaw class. The attacker crafts a CSV file composed of "millions of tiny records" — an intentionally high record count with minimal per-record content. The file is submitted as a multipart/form-data upload (a standard CSV migration upload) to POST /api/v2/migration/csv/migrate. Because the server does not limit parsed row cardinality, it proceeds to parse all supplied records.

4. Payload / execution method (class level). This is not a code-execution or memory-corruption attack; the payload is data, not code. The "weaponization" is volumetric at the logical-record level. The attacker exploits the asymmetry between small uploaded bytes and large per-record server-side processing/allocation. The concrete impact is driven by row count, not file size.

5. Post-exploitation impact. As parsing proceeds, process memory consumption grows until allocation fails or the process is terminated by the OS/OOM killer, taking down the API service. No confidentiality or integrity impact is expected (C:N/I:N). Repeated submissions can sustain a denial-of-service condition against API availability.

No specific parser internals, code snippets, or hypothetical function names are asserted, as none are provided in the source data.

Impact Assessment

The primary impact is to availability (A:H). A successful attack terminates the Vikunja API service, denying access to all users of the instance until the process is restarted or resources recovered. There is no expected impact on confidentiality (C:N) or integrity (I:N), and scope is unchanged (S:U).

Blast radius depends on deployment architecture:

• Single-instance / monolithic deployments: One exploitable request can take down the entire API for all tenants and users.
• Multi-tenant or shared-hosting deployments: A single authenticated tenant can degrade or deny service to unrelated tenants sharing the same process or host memory budget.
• Containerized/Kubernetes deployments: OOM-triggered termination may cause crash-loop restarts, producing sustained instability rather than a single outage.

The overall CVSS 6.5 (Medium) reflects the requirement for authentication and the availability-only impact. EPSS is 0.00338 (27.1th percentile), indicating low predicted near-term exploitation likelihood. There is no CISA KEV listing, no public exploit, and no observed threat-actor campaign in the provided data.

Business considerations: self-hosted Vikunja instances used for team task tracking, or those exposed on the public internet, are most exposed. Because the prerequisite is a valid account, risk is elevated in environments with open registration or weak account-provisioning controls, where an attacker may self-provision an account to meet PR:L.

Detection Guidance

Sigma Rule

title: Vikunja CSV Migration Resource Exhaustion Attempt (CVE-2026-91969)
id: 6f2c1a94-1d2b-4e77-9b0a-cve202691969
status: experimental
description: Detects POST requests to the Vikunja CSV migration endpoint, indicative of resource exhaustion attempts (CVE-2026-91969).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91969
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1499
  - cve.2026.91969
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains: '/api/v2/migration/csv/migrate'
  condition: selection_method and selection_uri
falsepositives:
  - Legitimate large CSV migrations by administrators
level: medium

YARA Rule

rule CVE_2026_91969_Vikunja_CSV_Resource_Exhaustion
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects multipart uploads targeting the Vikunja CSV migration endpoint (CVE-2026-91969)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91969"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $endpoint = "/api/v2/migration/csv/migrate" ascii wide nocase
        $multipart = "Content-Disposition: form-data" ascii nocase
        $csvfield = "name=\"csv\"" ascii wide nocase

    condition:
        (uint16(0) == 0x0A0D or true) and
        $endpoint and $multipart
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91969 Vikunja CSV Migration Resource Exhaustion Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v2/migration/csv/migrate"; http.header; content:"multipart/form-data"; classtype:attempted-dos; reference:cve,2026-91969; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91969; sid:202691969; rev:1;)

Elastic Detection

sequence by user.name with maxspan=1m
  [ network where http.request.method == "POST"
      and url.path == "/api/v2/migration/csv/migrate"
      and http.request.body.content != null ]

Splunk SPL Query

index=web OR index=proxy
| eval uri = coalesce(uri, url, cs_uri_stem)
| where match(uri, "/api/v2/migration/csv/migrate")
| where lower(method)=="post" OR match(http_method, "(?i)post")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as source_ips
        sum(coalesce(bytes_in, request_length, 0)) as total_bytes
        by user, uri
| where count >= 1
| sort - total_bytes

Wazuh OSSEC Rule

<group name="web,vikunja,cve-2026-91969">
  <rule id="2026919" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>/api/v2/migration/csv/migrate</url>
    <description>CVE-2026-91969: Possible Vikunja CSV migration resource exhaustion attempt (POST /api/v2/migration/csv/migrate)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>denial_of_service,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate mitigations

   • Restrict access to POST /api/v2/migration/csv/migrate at the reverse proxy/WAF so that only trusted administrative roles can invoke it; the CVSS PR:L precondition means limiting which accounts can reach the endpoint directly reduces exposure.
   • Apply request-body size limits and rate limiting on the migration endpoint at the proxy layer. Note that because the attack uses many tiny records rather than large bytes, size limits alone may be insufficient — rate limiting and account restriction are the more effective compensating controls.
   • Monitor and alert on repeated POST requests to the CSV migration path and on API process restarts / OOM events.
   • In environments with open or self-service registration, disable open signup to prevent attackers from self-provisioning the required authenticated account.

2. Patch / upgrade steps

   • Upgrade Vikunja to 2.6.0 or later, which is claimed to enforce a parsed-row-cardinality limit. This fix is asserted by a single source (OSV) and should be independently validated against the vendor's release notes and repository before relying on it.
   • Verify the deployed version and confirm the endpoint behavior after upgrade with a controlled test upload.

3. Long-term hardening

   • Enforce resource ceilings on file-parsing/import operations (maximum row count, maximum total parsed records, and per-request memory bounds) as a general engineering control.
   • Run the API service under container/cgroup memory limits with automatic restart to bound the blast radius of any future resource-exhaustion flaw.
   • Maintain least-privilege role assignment so that migration/import capabilities are not available to ordinary users.
   • Track vendor advisories for Vikunja and subscribe to NVD/OSV feeds for this CVE and its fixes.

References

• NVD — CVE-2026-91969: https://nvd.nist.gov/vuln/detail/CVE-2026-91969
• OSV Advisory (single-source patch claim for 2.6.0): https://osv.dev/
• CWE-400 — Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• Vikunja project (vendor source and release notes): https://github.com/go-vikunja/vikunja

Threat-actor / in-the-wild evidence: None identified. EPSS 0.00338 (27.1th percentile), no CISA KEV listing, no public PoC, no Nuclei template, and no exploit code were found in the provided intelligence. Exploitation activity is not currently observed; this report is based on the vulnerability class and NVD description only.