{"id":"CVE-2026-112289","kind":"vulnerability","aliases":["CVE-2026-112289"],"related":[],"title":"Koalixcrm: stored XSS in task titles lets staff create superusers","description":"Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.link_to_task(). Attackers can embed HTML or script that executes when administrators open the task changelist or change form, enabling actions like creating a superuser.","summary":"Koalixcrm through 1.14.0 renders task titles without escaping in Task.link_to_task(), so a staff user can store script in a task title. When an administrator opens the task changelist or change form, that script runs in their session and can be used to create a superuser.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["django","koalixcrm","package","python","self-hosted"],"not_affected_if":["no-staff-task-editing","not-running-koalixcrm"],"how_to_check":"- Check the installed Koalixcrm version against the release notes; the affected range is through `1.14.0`\n- Look for `link_to_task` in the Task admin code of your installed copy to confirm the unescaped rendering is present\n- unknown whether a settings change alone mitigates it","fix":"- Upgrade Koalixcrm to a version later than `1.14.0` once a fixed release is available; unknown which version carries the fix\n- Until then, restrict staff accounts to trusted users and review existing task titles for embedded HTML or script","status":"open","published_at":"2026-10-19T14:17:07+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:16:47+00:00","updated_at":"2026-10-25T04:16:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:16:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Koalixcrm to a version later than `1.14.0` once a fixed release is available; unknown which version carries the fix\n- Until then, restrict staff accounts to trusted users and review existing task titles for embedded HTML or script","reach":"network","title":"Koalixcrm: stored XSS in task titles lets staff create superusers","impact":"high","summary":"Koalixcrm through 1.14.0 renders task titles without escaping in Task.link_to_task(), so a staff user can store script in a task title. When an administrator opens the task changelist or change form, that script runs in their session and can be used to create a superuser.","category":"package","nicknames":[],"who_cares":["koalixcrm","python","django","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Admin session hijacked; attacker creates a superuser account","analyst_note":"Confirm the fixed Koalixcrm version and whether a patch exists beyond 1.14.0; the NVD entry gives no fix or check steps.","how_to_check":"- Check the installed Koalixcrm version against the release notes; the affected range is through `1.14.0`\n- Look for `link_to_task` in the Task admin code of your installed copy to confirm the unescaped rendering is present\n- unknown whether a settings change alone mitigates it","needs_analyst":true,"not_affected_if":["no-staff-task-editing","not-running-koalixcrm"],"who_is_affected":"Teams running self-hosted Koalixcrm up to and including 1.14.0 where non-administrative staff users can create or edit tasks. Exposure depends on administrators opening the task pages, so instances where only trusted staff can write tasks carry less risk. Teams not running Koalixcrm can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000654,"input_tokens":3333,"output_tokens":642,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112289':13A,16A '-2026':12A,15A '1.14.0':26B,73C 'action':118C 'administr':49B,109C 'allow':83C 'attack':100C 'chang':55B,115C 'changelist':53B,113C 'contain':74C 'creat':9A,68B,120C 'cross':78C 'cross-sit':77C 'cve':11A,14A 'django':17B 'emb':102C 'enabl':117C 'escap':31B 'execut':107C 'form':56B,116C 'host':23B 'html':103C 'inject':87C 'koalixcrm':1A,18B,24B,71C 'let':7A 'like':119C 'malici':91C 'open':50B,110C 'packag':19B 'python':20B 'render':27B,94C 'run':59B 'script':42B,58B,80C,88C,105C 'self':22B 'self-host':21B 'session':62B 'site':79C 'staff':8A,38B,84C 'store':2A,41B,76C,90C 'superus':10A,70B,122C 'task':5A,28B,35B,45B,52B,92C,99C,112C 'task.link':33B,97C 'titl':6A,29B,46B,93C 'unescap':95C 'use':66B 'user':39B,85C 'vulner':81C 'without':30B 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Koalixcrm up to and including 1.14.0 where non-administrative staff users can create or edit tasks. Exposure depends on administrators opening the task pages, so instances where only trusted staff can write tasks carry less risk. Teams not running Koalixcrm can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112289","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112289","severity":null,"published_at":"2026-10-19T14:17:07+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}