CVE-2026-112289: Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin
Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.linktotask(). Attackers can embed HTML or script that executes when administrators open the task changelist or change form, enabling actions like creating a superuser.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk when it is triggered?
A staff user who can create or modify task titles can store malicious HTML or script. Administrators are exposed when they open the Django admin task changelist or an affected task change form.
Does exploitation require user interaction?
Yes. The stored payload executes when an administrator views a page that renders the malicious task title, specifically the task changelist or change form.
What impact can a successful attack have?
The script runs in the administrator's browser context and can perform actions available to that administrator. The reported example includes creating a superuser.
How can I determine whether my deployment may be affected?
Deployments running KoalixCRM through version 1.14.0 may be affected. Review task titles created or edited by staff users, particularly before administrators view them in Django admin.