Live › vulnerability › CVE-2026-115507
Go to dashboardVikunja 2.2.0 through 2.6.x builds notification emails by pasting display names and task or project titles straight into HTML anchors without escaping. An authenticated user can craft a name that closes the anchor and injects a phishing link into comment and mention emails sent to other project members.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or managed Vikunja instances on versions from 2.2.0 up to but not including 2.7.1 that send task-comment or task-mention emails. The exposure needs a user account on the instance that can create tasks or projects, and the injected link reaches other project members by email. Instances with mail disabled or already on 2.7.1 or later are not affected.
No product ranges from the sources yet.
vikunja version or the About page, and see whether it is between 2.2.0 and 2.7.0.2.7.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members.
This page as .md · .json · in your agent: get_signal("CVE-2026-115507")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.