CVE-2026-91968

Vikunja, the open-source self-hosted to-do/task management application, contains an uncontrolled recursion vulnerability (CWE-674) in its task-filter endpoint in all versions before 2.6.0. The filter expression parser accepts arbitrarily deeply nested parentheses in the filter query parameter without any recursion depth limit, so an authenticated user can submit thousands of nested operators to drive deep recursion, exhaust memory, and terminate the API process. Successful exploitation causes a denial of service affecting availability for all users of the targeted instance; no data confidentiality or integrity impact is expected. The attack requires a valid account on the instance, and the flaw only affects self-hosted Vikunja deployments running versions prior to 2.6.0. No public proof of concept or in-the-wild exploitation is currently known.

What to do: Upgrade to Vikunja 2.6.0 or later, which enforces recursion depth limits on filter expressions. Until patched, restrict user registration and API token issuance to trusted accounts, since exploitation requires authentication. Review logs for repeated API process crashes or restarts and anomalous filter query parameters as indicators of abuse attempts.