CVE-2026-123525 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja's Trello, Todoist and Microsoft To Do migration importers download attachments and API responses into memory without size limits. An authenticated user can start a migration that exhausts server memory and crashes the API process shared by all users.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted Vikunja instances before 2.7.1 that let users run the Trello, Todoist or Microsoft To Do migration importers. Exposure needs an account on the instance, since the migration feature requires authentication. Instances without these importers enabled for users are less exposed, but the sources do not say how to disable them.
Not affected if auth-required, managed-hosting
Who cares go, self-hosted, vikunja
vikunja version or the image tag in your deployment; versions before 2.7.1 are affected.2.7.1 or later.Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attachment downloads and API responses in memory without size caps. Authenticated users can start a migration that references huge attacker-served attachments or yields oversized API responses, exhausting memory and crashing the shared API process for all tenants.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.