Vulnerability Description
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members.
CVSS Score
LOW
Related Weaknesses (CWE)
References
- https://github.com/go-vikunja/vikunja
- https://github.com/go-vikunja/vikunja/blob/v2.7.0/pkg/notifications/mail.go#L132
- https://github.com/go-vikunja/vikunja/commit/18ff05932632c65dbc90a88118597989c6a
- https://github.com/go-vikunja/vikunja/releases/tag/v2.7.1
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rp33-8f2m-hm6j
- https://www.vulncheck.com/advisories/vikunja-2.2.0-before-2.7.1-html-injection-v
FAQ
What is CVE-2026-115507?
CVE-2026-115507 is a vulnerability with a CVSS score of 3.5 (LOW). Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into emai...
How severe is CVE-2026-115507?
CVE-2026-115507 has been rated LOW with a CVSS base score of 3.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-115507?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.