PT-2026-121581

CVE-2026-115507

Published

2026-10-22

Updated

2026-10-22

Description by

CVSS 4.0

5.1

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vikunja versions 2.2.0 through 2.7.0

Description An HTML injection issue exists in the CreateConversationalHeader function within pkg/notifications/mail.go. The system fails to properly sanitize display names, task titles, and project titles before interpolating them into email anchors. Authenticated users can exploit this by crafting specific titles or display names to close the anchor tag and inject phishing links into task-comment and task-mention notification emails sent to project members.

Recommendations Update to version 2.7.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2026-115507