{"id":"CVE-2026-123515","kind":"vulnerability","aliases":["CVE-2026-123515"],"related":[],"title":"Vikunja: stored rich-text images make viewers' browsers request internal addresses","description":"Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content.","summary":"Vikunja before 2.7.1 lets a user with write access store img tags in tasks, comments or descriptions that make other viewers' browsers send GET requests to loopback or LAN addresses. An attacker can probe local services blindly and learn when people open the content.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","vikunja"],"not_affected_if":["managed-hosting","single-user-instance"],"how_to_check":"- Check the Vikunja version: `vikunja version` or the version shown in the web UI; affected versions are below `2.7.1`\n- Confirm whether users outside trusted teams can write tasks, comments or project descriptions","fix":"- Vikunja: upgrade to `2.7.1` or later","status":"open","published_at":"2026-11-08T02:16:40+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","triaged_at":"2026-11-08T02:25:27+00:00","updated_at":"2026-11-08T02:25:27+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:25:27Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: upgrade to `2.7.1` or later","reach":"network","title":"Vikunja: stored rich-text images make viewers' browsers request internal addresses","impact":"low","summary":"Vikunja before 2.7.1 lets a user with write access store img tags in tasks, comments or descriptions that make other viewers' browsers send GET requests to loopback or LAN addresses. An attacker can probe local services blindly and learn when people open the content.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Viewers' browsers probe internal services and reveal when content is opened","analyst_note":"","how_to_check":"- Check the Vikunja version: `vikunja version` or the version shown in the web UI; affected versions are below `2.7.1`\n- Confirm whether users outside trusted teams can write tasks, comments or project descriptions","plain_action":"","needs_analyst":false,"not_affected_if":["single-user-instance","managed-hosting"],"who_is_affected":"Teams that self-host Vikunja and let users with write access edit tasks, comments, project descriptions or import Markdown. Viewers' browsers make the requests, so internal services reachable from staff laptops are the exposed targets. Installations that are only used by a single trusted user, or that do not run on a network with internal services, carry much less risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":4280,"output_tokens":539,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123515':15A,18A '-2026':14A,17A '2.7.1':26B,70C 'access':32B,84C 'address':12A,53B,93C 'allow':80C 'attack':55B,101C 'blind':60B,115C 'browser':9A,45B 'client':74C,88C 'client-sid':73C 'comment':38B,107C 'contain':71C 'content':67B,126C 'cve':13A,16A 'descript':40B,109C 'element':97C 'forgeri':77C 'get':47B,116C 'host':22B 'imag':6A,104C 'img':34B,96C 'import':111C 'intern':11A 'lan':52B,92C 'learn':62B 'let':27B 'local':58B,119C 'loopback':50B,90C 'make':7A,42B,86C 'markdown':112C 'open':65B,125C 'packag':19B 'peopl':64B 'plant':103C 'probe':57B 'project':108C 'request':10A,48B,76C,89C,117C 'rich':4A,99C 'rich-text':3A 'self':21B 'self-host':20B 'send':46B 'servic':59B,120C 'side':75C 'store':2A,33B,95C 'tag':35B 'task':37B,106C 'text':5A,100C 'track':122C 'trigger':114C 'user':29B,81C 'viewer':8A,44B,87C,124C 'vikunja':1A,23B,24B,68C 'vulner':78C 'write':31B,83C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Vikunja and let users with write access edit tasks, comments, project descriptions or import Markdown. Viewers' browsers make the requests, so internal services reachable from staff laptops are the exposed targets. Installations that are only used by a single trusted user, or that do not run on a network with internal services, carry much less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","vikunja"],"campaign_type":null,"search_a":"'-123515':15A,18A '-2026':14A,17A 'address':12A 'browser':9A 'cve':13A,16A 'imag':6A 'intern':11A 'make':7A 'request':10A 'rich':4A 'rich-text':3A 'store':2A 'text':5A 'viewer':8A 'vikunja':1A","search_b":"'2.7.1':26B 'access':32B 'address':53B 'attack':55B 'blind':60B 'browser':45B 'comment':38B 'content':67B 'descript':40B 'get':47B 'host':22B 'img':34B 'lan':52B 'learn':62B 'let':27B 'local':58B 'loopback':50B 'make':42B 'open':65B 'packag':19B 'peopl':64B 'probe':57B 'request':48B 'self':21B 'self-host':20B 'send':46B 'servic':59B 'store':33B 'tag':35B 'task':37B 'user':29B 'viewer':44B 'vikunja':23B,24B 'write':31B","search_c":"'2.7.1':70C 'access':84C 'address':93C 'allow':80C 'attack':101C 'blind':115C 'client':74C,88C 'client-sid':73C 'comment':107C 'contain':71C 'content':126C 'descript':109C 'element':97C 'forgeri':77C 'get':116C 'imag':104C 'img':96C 'import':111C 'lan':92C 'local':119C 'loopback':90C 'make':86C 'markdown':112C 'open':125C 'plant':103C 'project':108C 'request':76C,89C,117C 'rich':99C 'servic':120C 'side':75C 'store':95C 'task':106C 'text':100C 'track':122C 'trigger':114C 'user':81C 'viewer':87C,124C 'vikunja':68C 'vulner':78C 'write':83C","first_public_at":"2026-10-22T10:04:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123515","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123515","severity":null,"published_at":"2026-11-08T02:16:40+00:00","modified_at":"2026-11-08T02:16:40+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","fetched_at":"2026-11-08T02:21:08+00:00","note":null}],"documents":[{"id":99179,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2f75-93c9-xf32","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:04:50+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99180,"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-client-side-request-forgery-via-stored-rich-text-images","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}