CVE-2026-123515 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja before 2.7.1 lets a user with write access store img tags in tasks, comments or descriptions that make other viewers' browsers send GET requests to loopback or LAN addresses. An attacker can probe local services blindly and learn when people open the content.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host Vikunja and let users with write access edit tasks, comments, project descriptions or import Markdown. Viewers' browsers make the requests, so internal services reachable from staff laptops are the exposed targets. Installations that are only used by a single trusted user, or that do not run on a network with internal services, carry much less risk.
Not affected if managed-hosting, single-user-instance
Who cares self-hosted, vikunja
vikunja version or the version shown in the web UI; affected versions are below 2.7.12.7.1 or laterVikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.