Vikunja before 2.7.1 allocates memory for Trello, Todoist and Microsoft To Do migration importers without limits, buffering remote attachment downloads and API responses that can be arbitrarily large. An authenticated user can trigger a migration that references attacker‑served huge attachments or very large API responses. This consumes all available memory and crashes the shared API process, causing a denial of service for all tenants.

The vulnerability affects the open‑source task‑management platform Vikunja from the vendor go‑vikunja. It is documented to exist in releases prior to 2.7.1; however, the CVE does not provide a detailed affected-version list.

The CVSS score of 7.1 indicates a high severity. Exploitation requires only authenticated access to the migration feature; no additional privileges are needed. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw allows a user to exhaust memory and crash the process, attackers can easily cause service disruption. The typical attack vector involves uploading or pointing to large external attachments during a migration.