CVE-2026-115507: Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the injected content?
An authenticated user who can set a display name or create/edit task or project titles can craft malicious HTML. Project members receiving task-comment or task-mention notification emails may be exposed to phishing links injected into those emails.
Which versions are affected?
Vikunja versions from 2.2.0 before 2.7.1 are affected. Version 2.7.1 is not listed as affected.
Does exploitation require user interaction?
Yes. The vulnerability requires an authenticated attacker to supply crafted content and a recipient to interact with the resulting notification email, such as following an injected phishing link.