CVE-2026-123515

MediumCVSS 4.1/10Last modified Nov 12, 2026

Description

Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content.

Metrics

CVSS 3.1 4.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-441

Affected software

VendorProductVersions
go-vikunjavikunja< 2.7.1

References

Timeline

Published
Nov 8, 2026
Last modified
Nov 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1235164.3Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consumCVE-2026-1235174.3Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exiCVE-2026-1235184.3Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's prCVE-2026-1235196.5Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WCVE-2026-123525.9This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device.CVE-2026-1235207.1Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or ownership of read-onCVE-2026-1235215.9Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts vulnerability that allows session holders to brutCVE-2026-1235227.1Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted CVE-2026-1235236.5Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory byCVE-2026-1235245.7Vikunja from 0.23.0 before 2.7.1 contains an information disclosure vulnerability that allows project collaborators with write access to reaCVE-2026-1235256.5Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attCVE-2026-1235265.4Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only external_id field thro
CVE-2026-123515: Medium severity, CVSS 4.1 | Vulnix