CVE-2026-123525

EUVD-2026-119410
Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attachment downloads and API responses in memory without size caps. Authenticated users can start a migration that references huge attacker-served attachments or yields oversized API responses, exhausting memory and crashing the shared API process for all tenants.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 23.63%
Common Weakness Enumeration
References
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-wqjr-22r7-5437
https://www.vulncheck.com/advisories/vikunja-before-2.7.1-memory-exhaustion-dos-via-trello-todoist-and-microsoft-to-do-migrations