CVE-2026-115507

medium

Description

Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members.

References

https://www.vulncheck.com/advisories/vikunja-2.2.0-before-2.7.1-html-injection-via-notification-email-header

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rp33-8f2m-hm6j

https://github.com/go-vikunja/vikunja/releases/tag/v2.7.1

https://github.com/go-vikunja/vikunja/commit/18ff05932632c65dbc90a88118597989c6af4bf9

https://github.com/go-vikunja/vikunja/blob/v2.7.0/pkg/notifications/mail.go#L132-L148

https://github.com/go-vikunja/vikunja

Details

Source: Mitre, NVD

Published: 2026-10-22

Updated: 2026-10-22

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 3.5

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Severity: Low

CVSS v4

Base Score: 5.1

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Severity: Medium