PT-2026-139810

CVE-2026-123529

Published

2026-11-08

Updated

2026-11-08

Description by

CVSS 4.0

5.1

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.7.1

Description Authenticated users with project write access can perform a stored CSS injection. This occurs through unsanitized data-background-color attributes in table cells. An attacker can store crafted task descriptions or comments to create full-viewport phishing overlays or trigger zero-click outbound background-image requests, which can deanonymize viewers.

Recommendations Update to version 2.7.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-1021: Improper Restriction of Rendered UI Layers or Frames

Related identifiers

CVE-2026-123529