CVE-2026-115507: Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header
Received
Published 22-10-2026Last modified 22-10-2026
Vulnerability summary
CVE-2026-115507 is a medium (CVSS 5.1) Cross-site Scripting vulnerability in go-vikunja vikunja.
CVSS score
5.1/10
010
Medium · v4.0 (CVE.org)EPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Timeline
- 22-10-2026PublishedVulnerability first disclosed.
Description
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members.
CVSS metrics
4 scores · 2 sources · 2 versionsMedium 5.1Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NSourcesAll 2 agree
- NVDNIST5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low 3.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:NSourcesAll 2 agree
- NVDNIST3.5LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Go-vikunja1 product
- vikunja≥ 2.2.0, < 2.7.1
1 vendor · 1 product
References
6 links- github.com/go-vikunja/vikunja/blob/v2.7.0/pkg/notifications/mail.goTechnical Description
- github.com/go-vikunja/vikunja/releases/tag/v2.7.1Release Notes