CVE-2026-112289
Received Received - Intake

Stored XSS in KoalixCRM Task Titles via Unsanitized Input

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.link_to_task(). Attackers can embed HTML or script that executes when administrators open the task changelist or change form, enabling actions like creating a superuser.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112289
EUVD
EUVD-2026-104284

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
KoalixSwitzerland koalixcrm 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Koalixcrm through version 1.14.0 has a stored cross-site scripting (XSS) vulnerability. Staff users can inject malicious scripts by creating task titles with harmful code. When administrators view the task list or form, the script executes because the task titles are not properly escaped. This could allow attackers to perform actions like creating a superuser account.

Impact Analysis

If you are an administrator using Koalixcrm, attackers with staff access could exploit this to run malicious scripts in your browser. This may lead to unauthorized actions like creating admin accounts, stealing session cookies, or performing other harmful tasks without your knowledge.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by enabling unauthorized access to sensitive data or administrative functions. If exploited, it may lead to data breaches or unauthorized modifications, resulting in legal penalties or loss of trust.

Mitigation Strategies

Update Koalixcrm to the latest version beyond 1.14.0 to patch the stored XSS vulnerability in task titles. Review and sanitize any existing task titles containing scripts or HTML. Restrict staff user permissions to minimize injection risks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart