Vikunja versions between 1.0.0 and 2.7.1 contain an uncontrolled resource consumption flaw that allows an authenticated user to bypass the configured maximum items per page by passing a page=0 parameter to any list endpoint. This bypass enables an attacker to trigger unbounded SQL queries, memory materialisation and per‑row query fan‑out, exhausting server resources and degrading service availability for other users. The weakness aligns with CWE-400, uncontrolled resource consumption.

The vulnerability affects the open‑source task‑management platform Vikunja, specifically the core application packaged under the vendor name go‑vikunja. The affected build range spans all releases starting at 1.0.0 up to, but not including, 2.7.1. No additional vendor or product variants are listed.

The CVSS score of 8.7 categorises this issue as high severity, indicating significant impact if exploitation occurs. Although the EPSS score is not publicly available, the design of the flaw makes exploitation straightforward for any user that has successfully registered, especially when self‑registration is enabled. The vulnerability is not currently listed in CISA's KEV catalog, but its availability‑denial nature and the fact that it requires only user credentials imply a non‑negligible threat for deployed installations with inadequate access controls.