Memory Exhaustion Vulnerability in Vikunja Migration Importers
CVE-2026-123525

7.1HIGH

Key Information:

Vendor

Go-vikunja

Status
Vikunja
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123525?

The Vikunja platform, prior to version 2.7.1, is susceptible to a memory exhaustion issue within its migration importers for Trello, Todoist, and Microsoft To Do. This vulnerability permits authenticated users to initiate a migration that can reference excessively large attachments or produce oversized API responses. The lack of memory allocation limits in these processes can lead to the exhaustion of available memory, potentially crashing the shared API process and impacting all tenants utilizing the system.

Affected Version(s)

vikunja 0 < 2.7.1

vikunja 2.7.1

References

https://github.com/go-vikunja/vikunja/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/vikunja-before-2.7.1...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
.