CVE-2026-123525: Vikunja unbounded memory allocation in migration importers

CVE-2026-123525 · Severity: medium · CVSS 6.5 · Published 2026-11-08

Vikunja is a task management and organization platform that supports importing tasks from Trello, Todoist, and Microsoft To Do. An authenticated user can trigger a migration that downloads large attachments or API responses without size limits, exhausting the server's memory and crashing the shared API process for all users on the instance.

Technologies: Vikunja. Vendors: Vikunja.

Quick answers

Is CVE-2026-123525 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-123525 being exploited in the wild.
How severe is CVE-2026-123525?
Medium severity, with a CVSS score of 6.5, published 8 November 2026.
Which products and versions are affected?
Vikunja before 2.7.1.
Is there a fix for CVE-2026-123525?
Yes: fixed in 2.7.1. Until then: Disable the Trello, Todoist, and Microsoft To Do migration importers by setting migration.trello.enable=false, migration.todoist.enable=false, and migration.microsoft_todo.enable=false in the Vikunja configuration until upgrading to version 2.7.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123525 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-123525?
Check whether you run Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 2.7.1

Disable the Trello, Todoist, and Microsoft To Do migration importers by setting migration.trello.enable=false, migration.todoist.enable=false, and migration.microsoft_todo.enable=false in the Vikunja configuration until upgrading to version 2.7.1.

Technical details

The Trello, Todoist, and Microsoft To Do migration importers in Vikunja use unbounded buffering when downloading remote attachments and parsing API responses. The vulnerability stems from use of buf.ReadFrom(resp.Body) without size caps in DownloadFile and DownloadFileWithHeaders functions, combined with lack of aggregate item limits in paginated API loops. An authenticated user with migration features enabled can exhaust memory via attacker-controlled attachment URLs or oversized API responses, triggering an OOM kill of the in-process API server that affects all tenants.

Affected products

  • Vikunja Vikunja before 2.7.1

Timeline

  • 2026-10-22: disclosed
  • 2026-11-07: advisory
  • 2026-11-08: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.