{"id":"CVE-2026-123525","kind":"vulnerability","aliases":["CVE-2026-123525"],"related":[],"title":"Vikunja: migration importers load unlimited data into memory, crashing the API","description":"Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attachment downloads and API responses in memory without size caps. Authenticated users can start a migration that references huge attacker-served attachments or yields oversized API responses, exhausting memory and crashing the shared API process for all tenants.","summary":"Vikunja's Trello, Todoist and Microsoft To Do migration importers download attachments and API responses into memory without size limits. An authenticated user can start a migration that exhausts server memory and crashes the API process shared by all users.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["go","package","self-hosted","vikunja"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"- Check the Vikunja version with `vikunja version` or the image tag in your deployment; versions before `2.7.1` are affected.\n- Confirm whether the Trello, Todoist or Microsoft To Do migration feature is reachable by users on your instance.","fix":"- Vikunja: move to `2.7.1` or later.","status":"open","published_at":"2026-11-08T02:16:42+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","triaged_at":"2026-11-08T02:23:26+00:00","updated_at":"2026-11-08T02:23:26+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:23:26Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: move to `2.7.1` or later.","reach":"network","title":"Vikunja: migration importers load unlimited data into memory, crashing the API","impact":"medium","summary":"Vikunja's Trello, Todoist and Microsoft To Do migration importers download attachments and API responses into memory without size limits. An authenticated user can start a migration that exhausts server memory and crashes the API process shared by all users.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","go"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"API process crashes, taking down service for all tenants","analyst_note":"","how_to_check":"- Check the Vikunja version with `vikunja version` or the image tag in your deployment; versions before `2.7.1` are affected.\n- Confirm whether the Trello, Todoist or Microsoft To Do migration feature is reachable by users on your instance.","plain_action":"","needs_analyst":false,"not_affected_if":["auth-required","managed-hosting"],"who_is_affected":"Self-hosted Vikunja instances before 2.7.1 that let users run the Trello, Todoist or Microsoft To Do migration importers. Exposure needs an account on the instance, since the migration feature requires authentication. Instances without these importers enabled for users are less exposed, but the sources do not say how to disable them.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000693,"input_tokens":4295,"output_tokens":528,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123525':14A,17A '-2026':13A,16A '2.7.1':66C 'alloc':67C 'api':11A,37B,58B,87C,110C,118C 'attach':35B,84C,106C 'attack':104C 'attacker-serv':103C 'authent':45B,94C 'buffer':82C 'cap':93C 'crash':9A,56B,115C 'cve':12A,15A 'data':6A 'download':34B,85C 'exhaust':52B,112C 'go':18B 'host':22B 'huge':102C 'import':3A,33B,80C 'limit':43B,70C 'load':4A 'memori':8A,40B,54B,68C,90C,113C 'microsoft':29B,76C 'migrat':2A,32B,50B,79C,99C 'overs':109C 'packag':19B 'process':59B,119C 'refer':101C 'remot':83C 'respons':38B,88C,111C 'self':21B 'self-host':20B 'serv':105C 'server':53B 'share':60B,117C 'size':42B,92C 'start':48B,97C 'tenant':122C 'todoist':27B,74C 'trello':26B,73C 'unlimit':5A 'user':46B,63B,95C 'vikunja':1A,23B,24B,64C 'without':41B,69C,91C 'yield':108C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Vikunja instances before 2.7.1 that let users run the Trello, Todoist or Microsoft To Do migration importers. Exposure needs an account on the instance, since the migration feature requires authentication. Instances without these importers enabled for users are less exposed, but the sources do not say how to disable them.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["go","high","package","selfhosted","vikunja"],"campaign_type":null,"search_a":"'-123525':14A,17A '-2026':13A,16A 'api':11A 'crash':9A 'cve':12A,15A 'data':6A 'import':3A 'load':4A 'memori':8A 'migrat':2A 'unlimit':5A 'vikunja':1A","search_b":"'api':37B,58B 'attach':35B 'authent':45B 'crash':56B 'download':34B 'exhaust':52B 'go':18B 'host':22B 'import':33B 'limit':43B 'memori':40B,54B 'microsoft':29B 'migrat':32B,50B 'packag':19B 'process':59B 'respons':38B 'self':21B 'self-host':20B 'server':53B 'share':60B 'size':42B 'start':48B 'todoist':27B 'trello':26B 'user':46B,63B 'vikunja':23B,24B 'without':41B","search_c":"'2.7.1':66C 'alloc':67C 'api':87C,110C,118C 'attach':84C,106C 'attack':104C 'attacker-serv':103C 'authent':94C 'buffer':82C 'cap':93C 'crash':115C 'download':85C 'exhaust':112C 'huge':102C 'import':80C 'limit':70C 'memori':68C,90C,113C 'microsoft':76C 'migrat':79C,99C 'overs':109C 'process':119C 'refer':101C 'remot':83C 'respons':88C,111C 'serv':105C 'share':117C 'size':92C 'start':97C 'tenant':122C 'todoist':74C 'trello':73C 'user':95C 'vikunja':64C 'without':69C,91C 'yield':108C","first_public_at":"2026-10-22T10:07:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123525","severity":null,"published_at":"2026-11-08T02:16:42+00:00","modified_at":"2026-11-08T02:16:42+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","fetched_at":"2026-11-08T02:21:09+00:00","note":null}],"documents":[{"id":99199,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-wqjr-22r7-5437","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:07:33+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99200,"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-memory-exhaustion-dos-via-trello-todoist-and-microsoft-to-do-migrations","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}