Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-123525— Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrations

Quick assessment

Affected
go-vikunja vikunja
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 2.7.1 版本之前，Vikunja 的 Trello、Todoist 和 Microsoft To Do 迁移导入功能在分配内存时未设置限制。这些导入器会在内存中缓冲远程附件下载内容及 API 响应，且未对数据大小进行上限控制。经过身份验证的攻击者可发起迁移操作，引用由攻击者提供的超大附件，或触发返回超大响应的 API 接口，从而耗尽系统内存并导致所有租户共享的 API 进程崩溃。

CVSS 6.5 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-123525

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrations
Source: CVE Program / CVE List V5
Vulnerability Description
Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attachment downloads and API responses in memory without size caps. Authenticated users can start a migration that references huge attacker-served attachments or yields oversized API responses, exhausting memory and crashing the shared API process for all tenants.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
go-vikunja vikunja 0 ~ 2.7.1 -

II. Public POCs for CVE-2026-123525

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-123525

请登录查看更多情报信息。

Other References for CVE-2026-123525 (2)

Same Patch Batch · go-vikunja · 2026-11-08 · 39 CVEs total

CVE-2026-123531 8.8 HIGH Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter
CVE-2026-123522 7.1 HIGH Vikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhook
CVE-2026-123520 7.1 HIGH Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion
CVE-2026-123497 6.8 MEDIUM Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery
CVE-2026-123528 6.8 MEDIUM Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware
CVE-2026-123513 6.8 MEDIUM Vikunja before 2.7.1 Auth Token Leak via API URL Change
CVE-2026-123523 6.5 MEDIUM Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache
CVE-2026-123519 6.5 MEDIUM Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports
CVE-2026-123501 6.5 MEDIUM Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes
CVE-2026-123500 6.2 MEDIUM Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump
CVE-2026-123512 6.1 MEDIUM Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs
CVE-2026-123499 5.9 MEDIUM Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server
CVE-2026-123530 5.9 MEDIUM Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints
CVE-2026-123521 5.9 MEDIUM Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint
CVE-2026-123524 5.7 MEDIUM Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payload
CVE-2026-123505 5.5 MEDIUM Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database
CVE-2026-123493 5.4 MEDIUM Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens
CVE-2026-123506 5.4 MEDIUM Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints
CVE-2026-123526 5.4 MEDIUM Vikunja before 2.7.1 Mass Assignment via Team external_id Field
CVE-2026-123503 5.4 MEDIUM Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletion

Showing top 20 of 39 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: vikunja
Same vendor: go-vikunja
Same weakness: CWE-770