---
id: "CVE-2026-123515"
page: "https://infrastack.ai/live/CVE-2026-123515"
kind: "vulnerability"
aliases: ["CVE-2026-123515"]
title: "Vikunja: stored rich-text images make viewers' browsers request internal addresses"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "vikunja"]
not_affected_if: ["managed-hosting", "single-user-instance"]
published_at: "2026-11-08T02:16:40+00:00"
first_seen_at: "2026-11-08T02:21:08+00:00"
updated_at: "2026-11-08T02:25:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123515", "first_seen_at": "2026-11-08T02:21:08+00:00"}]
exploit_sources: []
---

# Vikunja: stored rich-text images make viewers' browsers request internal addresses

Link for people: https://infrastack.ai/live/CVE-2026-123515 (this .md is for agents)

Vikunja before 2.7.1 lets a user with write access store img tags in tasks, comments or descriptions that make other viewers' browsers send GET requests to loopback or LAN addresses. An attacker can probe local services blindly and learn when people open the content.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Vikunja version: `vikunja version` or the version shown in the web UI; affected versions are below `2.7.1`
- Confirm whether users outside trusted teams can write tasks, comments or project descriptions

## Fix

- Vikunja: upgrade to `2.7.1` or later

## Timeline

- 2026-11-08T02:21:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123515

## Documents

- [advisory] Vendor advisory: github.com https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2f75-93c9-xf32
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vikunja-before-2.7.1-client-side-request-forgery-via-stored-rich-text-images

## From the sources

Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_