CVE-2026-115507
Last modified
CVE-2026-115507 is a low-severity vulnerability rated 3.5/10 on the CVSS scale. Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members..
Description
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | >= 2.2.0, < 2.7.1 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-115507?
How severe is CVE-2026-115507?
How do I fix CVE-2026-115507?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-1155A vulnerability was found in Totolink LR350 9.3.5u.6369_B202…8.8
- CVE-2026-115502A missing authorization check allows anyone having access to…6.3
- CVE-2026-115503Ghidra before 12.2 contains an improper handling of highly c…5.5
- CVE-2026-115504CFITSIO through 4.7.0 contains an out-of-bounds write vulner…7.8
- CVE-2026-115505libsmb2 before 6.3 contains integer overflow vulnerabilities…7.6
- CVE-2026-115506libexpat through 2.9.0 contains a denial of service vulnerab…7.5
- CVE-2026-115508Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular …6.5
- CVE-2026-115509Jitsu console before 2.14.0-beta.41 contains an incorrect au…4.2
- CVE-2026-11551The Branda plugin for WordPress is vulnerable to privilege e…9.8
- CVE-2026-115513OpenCATS before 0.12.0 contains a stored cross-site scriptin…8.7
- CVE-2026-115516An incorrect authorization issue exposes basic account infor…6.9
- CVE-2026-115517Unrestricted network access between execution contexts in KN…6.4
Are you affected by CVE-2026-115507?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST