{"id":"CVE-2026-123529","kind":"vulnerability","aliases":["CVE-2026-123529"],"related":[],"title":"Vikunja: stored CSS injection in task descriptions enables phishing overlays","description":"Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport phishing overlays or force zero-click outbound background-image requests that deanonymize viewers.","summary":"Vikunja, a self-hosted task manager, fails to sanitize a table-cell data-background-color attribute, so CSS can be injected through stored task descriptions or comments. An attacker with project write access can display full-screen phishing overlays to other users or trigger background-image requests that reveal a viewer's IP address and identity.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","task-management","vikunja"],"not_affected_if":["managed-hosting-patched","read-only-projects","version-2.7.1-or-later"],"how_to_check":"- Check the installed Vikunja version; `2.7.1` or later is not affected by this flaw.\n- Look for who holds project write access on self-hosted Vikunja instances.","fix":"- Vikunja: move to `2.7.1` or later.","status":"open","published_at":"2026-11-08T02:16:42+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","triaged_at":"2026-11-08T02:25:25+00:00","updated_at":"2026-11-08T02:25:25+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:25:25Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: move to `2.7.1` or later.","reach":"network","title":"Vikunja: stored CSS injection in task descriptions enables phishing overlays","impact":"medium","summary":"Vikunja, a self-hosted task manager, fails to sanitize a table-cell data-background-color attribute, so CSS can be injected through stored task descriptions or comments. An attacker with project write access can display full-screen phishing overlays to other users or trigger background-image requests that reveal a viewer's IP address and identity.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","task-management"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"phishing overlay shown to viewers; viewer IP and identity exposed","analyst_note":"","how_to_check":"- Check the installed Vikunja version; `2.7.1` or later is not affected by this flaw.\n- Look for who holds project write access on self-hosted Vikunja instances.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.7.1-or-later","managed-hosting-patched","read-only-projects"],"who_is_affected":"Self-hosted Vikunja instances older than 2.7.1 where users have project write access. An attacker needs an account with write access on a project, and a viewer must open the affected task or comment.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000688,"input_tokens":4290,"output_tokens":519,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123529':13A,16A '-2026':12A,15A '2.7.1':88C 'access':60B,102C 'address':83B 'allow':96C 'arbitrari':105C 'attack':56B,117C 'attribut':43B,116C 'authent':97C 'background':41B,74B,114C,139C 'background-imag':73B,138C 'cell':38B,111C 'click':136C 'color':42B,115C 'comment':54B,124C 'contain':89C 'craft':120C 'css':3A,45B,92C,106C 'cve':11A,14A 'data':40B,113C 'data-background-color':39B,112C 'deanonym':143C 'descript':7A,52B,122C 'display':62B 'enabl':8A 'fail':32B 'forc':133C 'full':64B,128C 'full-screen':63B 'full-viewport':127C 'host':20B,29B 'ident':85B 'imag':75B,140C 'inject':4A,48B,93C,104C 'ip':82B 'manag':23B,31B 'outbound':137C 'overlay':10A,67B,131C 'packag':17B 'phish':9A,66B,130C 'project':58B,100C 'render':126C 'request':76B,141C 'reveal':78B 'sanit':34B 'screen':65B 'self':19B,28B 'self-host':18B,27B 'store':2A,50B,91C,119C 'tabl':37B,110C 'table-cel':36B,109C 'task':6A,22B,30B,51B,121C 'task-manag':21B 'trigger':72B 'unsanit':108C 'user':70B,98C 'via':107C 'viewer':80B,144C 'viewport':129C 'vikunja':1A,24B,25B,86C 'vulner':94C 'write':59B,101C 'zero':135C 'zero-click':134C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Vikunja instances older than 2.7.1 where users have project write access. An attacker needs an account with write access on a project, and a viewer must open the affected task or comment.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","taskmanagement","vikunja"],"campaign_type":null,"search_a":"'-123529':13A,16A '-2026':12A,15A 'css':3A 'cve':11A,14A 'descript':7A 'enabl':8A 'inject':4A 'overlay':10A 'phish':9A 'store':2A 'task':6A 'vikunja':1A","search_b":"'access':60B 'address':83B 'attack':56B 'attribut':43B 'background':41B,74B 'background-imag':73B 'cell':38B 'color':42B 'comment':54B 'css':45B 'data':40B 'data-background-color':39B 'descript':52B 'display':62B 'fail':32B 'full':64B 'full-screen':63B 'host':20B,29B 'ident':85B 'imag':75B 'inject':48B 'ip':82B 'manag':23B,31B 'overlay':67B 'packag':17B 'phish':66B 'project':58B 'request':76B 'reveal':78B 'sanit':34B 'screen':65B 'self':19B,28B 'self-host':18B,27B 'store':50B 'tabl':37B 'table-cel':36B 'task':22B,30B,51B 'task-manag':21B 'trigger':72B 'user':70B 'viewer':80B 'vikunja':24B,25B 'write':59B","search_c":"'2.7.1':88C 'access':102C 'allow':96C 'arbitrari':105C 'attack':117C 'attribut':116C 'authent':97C 'background':114C,139C 'background-imag':138C 'cell':111C 'click':136C 'color':115C 'comment':124C 'contain':89C 'craft':120C 'css':92C,106C 'data':113C 'data-background-color':112C 'deanonym':143C 'descript':122C 'forc':133C 'full':128C 'full-viewport':127C 'imag':140C 'inject':93C,104C 'outbound':137C 'overlay':131C 'phish':130C 'project':100C 'render':126C 'request':141C 'store':91C,119C 'tabl':110C 'table-cel':109C 'task':121C 'unsanit':108C 'user':98C 'via':107C 'viewer':144C 'viewport':129C 'vikunja':86C 'vulner':94C 'write':101C 'zero':135C 'zero-click':134C","first_public_at":"2026-10-22T10:09:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123529","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123529","severity":null,"published_at":"2026-11-08T02:16:42+00:00","modified_at":"2026-11-08T02:16:42+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","fetched_at":"2026-11-08T02:21:09+00:00","note":null}],"documents":[{"id":99207,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-p23m-cq25-pc4j","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:09:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99208,"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-stored-css-injection-via-tiptap-table-cell-data-background-color","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}