A nil pointer dereference in Vikunja releases 0.24.0 through 2.7.0 allows project administrators to inject a filter-mode bucket configuration with a null filter. When the system later attempts to read the view, the code in kanban and task collection panics, resulting in an HTTP 500 response for all project members. This flaw follows CWE-476, demonstrating that unvalidated null references can cause critical failures and disrupt service availability.

The vulnerability affects all instances of the Vikunja project persistence layer that run versions from 0.24.0 up to, but not including, 2.7.1. Users deploying these releases should verify their installed version against the vendor’s release notes.

The CVSS score of 5.1 indicates moderate severity; the absence of an EPSS score and non‑listing in the CISA KEV catalog suggest no known active exploitation at this time. However, because the flaw can be triggered by any project administrator, adversaries with administrative access or social engineering can cause sustained service disruption without needing external network exposure.