Vikunja 2.7.1 fixes a null-filter crash in project views

The Vikunja project has published a Low-severity advisory for its self-hosted task manager, and the fix is a one-step upgrade. According to the GitHub security advisory GHSA-hm4w-h7v8-ch43, published October 22, 2026, versions 0.24.0 through 2.7.0 of the code.vikunja.io/api Go package are affected, and 2.7.1 is the patched release. The advisory lists no CVE identifier.

What the advisory says

A project admin can save a filter-mode bucket configuration whose filter is null, or include a null configuration entry. The validator skips those entries, so the configuration is stored. Afterward, every read of that project view hits an unchecked dereference, panics, and returns HTTP 500 to all members of the project.

The maintainers note that the server’s recovery middleware catches the panic, so the process stays up. Only the one view becomes unreadable. Creating or editing a view already requires project admin rights, and that same admin can edit or delete the view, so the advisory describes no privilege gain.

The classification is CWE-20 (improper input validation) and CWE-476 (NULL pointer dereference). The project rates it Low on its CVSS v3.1 vector: network reachable, high privileges required, no user interaction, and a limited availability impact only. The advisory says it was found in an internal security review.

What to do

Upgrade to 2.7.1 or later. The fix rejects null configuration entries and null filters at validation time rather than guarding each place that reads them. If you run Vikunja with several project admins on shared projects, that is where this matters most, since a mistaken or careless save can break a view for everyone.

Analysis

This is a small bug, and the advisory says so plainly. It is still a useful example of a familiar pattern: a validator that skips empty values because they look harmless, and readers downstream that assume the validator already dealt with them. Fixing it at the point of entry, as the maintainers did, is the sturdier choice over patching three read sites. Self-hosted tools like this rarely get monitored as closely as the services around them, so a quiet upgrade is the right response here, not an emergency.