---
id: "CVE-2026-115507"
kind: "vulnerability"
aliases: ["CVE-2026-115507"]
title: "Vikunja: task and display names inject phishing links into notification emails"
severity: "medium"
cvss: 5.1
epss: 0.00197
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["email-notifications", "package", "self-hosted", "vikunja"]
not_affected_if: ["mailer-disabled", "version-2.7.1-or-later"]
published_at: "2026-10-22T20:17:06+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T04:28:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115507", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115507", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Vikunja: task and display names inject phishing links into notification emails

Vikunja 2.2.0 through 2.6.x builds notification emails by pasting display names and task or project titles straight into HTML anchors without escaping. An authenticated user can craft a name that closes the anchor and injects a phishing link into comment and mention emails sent to other project members.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Vikunja version the instance runs, for example `vikunja version` or the About page, and see whether it is between `2.2.0` and `2.7.0`.
- Confirm that mail notifications are enabled in the Vikunja config (mailer section) before treating the instance as exposed.

## Fix

- Upgrade Vikunja to `2.7.1` or later.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115507
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115507

## From the sources

Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_