Vikunja versions earlier than 2.7.1 allow project writers or view administrators to create an unbounded number of Kanban buckets because no count limit is enforced. When attackers create thousands of buckets, each read of a Kanban view triggers individual SELECT and COUNT queries for every bucket, causing excessive database load. The result is denial of service by exhausting database resources and degrading overall application responsiveness. This is an uncontrolled resource consumption weakness (CWE-770).

The vulnerability affects projects hosted with the Vikunja open‑source task‑tracking application, specifically any deployment running Vikunja prior to version 2.7.1. The affected vendor/product is go‑vikunja:vikunja, with all releases earlier than 2.7.1 exposed.

The CVSS score of 5.3 indicates moderate risk, and the EPSS score is not available, so current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. Attackers can exploit the flaw by creating many Kanban buckets through the user interface or API, assuming they hold project writer or view admin privileges.