Threats tagged 'ghsa-53m5-vjvm-vwjj'

Vikunja versions from 1.0.0 up to but not including 2.7.1 have a vulnerability that allows authenticated users to bypass the service.maxitemsperpage limit by sending page=0 to certain API list endpoints. This can cause unbounded SQL queries and excessive memory use, degrading service availability.