CVE-2026-115507 go-vikunja CVE debrief

Who should care

Defenders responsible for Vikunja installations, especially those using versions 2.2.0 before 2.7.1, should assess exposure and prioritize verification and remediation efforts. This includes reviewing system configurations, monitoring for suspicious activity, and educating users on the risks of phishing attacks. Additionally, defenders should consider implementing compensating controls for exposed systems and tracking exceptions and retesting remediated.

Why it matters

CVE-2026-115507 is an HTML injection vulnerability in Vikunja that allows authenticated users to inject phishing links into notification emails. Defenders should prioritize verifying exposure and assessing the impact on their systems, especially those using Vikunja for project management.

• Potential phishing attacks via injected links in notification emails
• Possible exploitation by authenticated users with malicious intent
• Required verification of Vikunja version and exposure
• Potential impact on project members who receive notification emails

Technical summary

The vulnerability is caused by the interpolation of display names and task and project titles into email anchors without proper sanitization. This allows authenticated users to craft malicious titles or display names that can close the anchor and inject phishing links into notification emails. The vulnerability affects Vikunja versions 2.2.0 before 2.7.1 and can be exploited by authenticated users with malicious intent. Defenders should prioritize verifying exposure and assessing the impact on their systems, especially those using Vikunja for project management.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using Vikunja for project management.

Recommended defensive actions

• Verify the version of Vikunja being used and assess exposure
• Upgrade to Vikunja version 2.7.1 or later
• Monitor notification emails for suspicious activity
• Educate users on the risks of phishing attacks
• Implement compensating controls for exposed systems
• Review asset inventory for affected systems
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability is caused by the interpolation of display names and task and project titles into email anchors without proper sanitization. This allows authenticated users to craft malicious titles or display names that can close the anchor and inject phishing links into notification emails.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.