{"id":"CVE-2026-115507","kind":"vulnerability","aliases":["CVE-2026-115507"],"related":[],"title":"Vikunja: task and display names inject phishing links into notification emails","description":"Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members.","summary":"Vikunja 2.2.0 through 2.6.x builds notification emails by pasting display names and task or project titles straight into HTML anchors without escaping. An authenticated user can craft a name that closes the anchor and injects a phishing link into comment and mention emails sent to other project members.","severity":"medium","cvss":5.1,"epss":0.00197,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-notifications","package","self-hosted","vikunja"],"not_affected_if":["mailer-disabled","version-2.7.1-or-later"],"how_to_check":"- Check the Vikunja version the instance runs, for example `vikunja version` or the About page, and see whether it is between `2.2.0` and `2.7.0`.\n- Confirm that mail notifications are enabled in the Vikunja config (mailer section) before treating the instance as exposed.","fix":"- Upgrade Vikunja to `2.7.1` or later.","status":"open","published_at":"2026-10-22T20:17:06+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:28:56+00:00","updated_at":"2026-10-25T04:28:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:28:56Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Vikunja to `2.7.1` or later.","reach":"internet","title":"Vikunja: task and display names inject phishing links into notification emails","impact":"low","summary":"Vikunja 2.2.0 through 2.6.x builds notification emails by pasting display names and task or project titles straight into HTML anchors without escaping. An authenticated user can craft a name that closes the anchor and injects a phishing link into comment and mention emails sent to other project members.","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","email-notifications"],"confidence":0.6,"needs_auth":"yes","worst_case":"Phishing links in trusted notification emails sent to project members","analyst_note":"","how_to_check":"- Check the Vikunja version the instance runs, for example `vikunja version` or the About page, and see whether it is between `2.2.0` and `2.7.0`.\n- Confirm that mail notifications are enabled in the Vikunja config (mailer section) before treating the instance as exposed.","needs_analyst":false,"not_affected_if":["version-2.7.1-or-later","mailer-disabled"],"who_is_affected":"Self-hosted or managed Vikunja instances on versions from 2.2.0 up to but not including 2.7.1 that send task-comment or task-mention emails. The exposure needs a user account on the instance that can create tasks or projects, and the injected link reaches other project members by email. Instances with mail disabled or already on 2.7.1 or later are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000619,"input_tokens":3391,"output_tokens":560,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115507':14A,17A '-2026':13A,16A '2.2.0':27B,76C '2.6':29B '2.7.1':78C 'anchor':46B,59B,100C,112C 'authent':50B,101C 'build':31B 'close':57B,110C 'comment':66B,120C 'contain':79C 'craft':53B,104C 'createconversationalhead':85C 'cve':12A,15A 'display':4A,36B,90C,107C 'email':11A,19B,33B,69B,99C,126C 'email-notif':18B 'escap':48B 'host':24B 'html':45B,81C 'inject':6A,61B,82C,114C 'interpol':89C 'link':8A,64B,116C 'member':74B,130C 'mention':68B,124C 'name':5A,37B,55B,91C,108C 'notif':10A,20B,32B,125C 'packag':21B 'past':35B 'phish':7A,63B,115C 'pkg/notifications/mail.go':87C 'project':41B,73B,95C,129C 'raw':97C 'self':23B 'self-host':22B 'sent':70B,127C 'straight':43B 'task':2A,39B,93C,119C,123C 'task-com':118C 'task-ment':122C 'titl':42B,96C,105C 'user':51B,102C 'vikunja':1A,25B,26B,75C 'vulner':83C 'without':47B 'x':30B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Vikunja instances on versions from 2.2.0 up to but not including 2.7.1 that send task-comment or task-mention emails. The exposure needs a user account on the instance that can create tasks or projects, and the injected link reaches other project members by email. Instances with mail disabled or already on 2.7.1 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T20:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115507","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115507","severity":null,"published_at":"2026-10-22T20:17:06+00:00","modified_at":"2026-10-23T13:19:13+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115507","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115507","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}