CVE-2026-123515
Deferred Deferred - Pending Action

Client-Side Request Forgery in Vikunja Rich Text

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123515
EUVD
EUVD-2026-119400

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja vikunja to 2.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Vikunja before version 2.7.1 has a client-side request forgery vulnerability. Users with write access can insert malicious img elements into tasks, comments, project descriptions, or Markdown content. When other users view this content, their browsers automatically send blind GET requests to loopback or LAN addresses, potentially exposing internal services.

Detection Guidance

Monitor network traffic for unexpected GET requests to loopback or LAN addresses from user browsers. Check Vikunja logs for suspicious image embeds in tasks, comments, or project descriptions. Use browser developer tools to inspect rich text content for img tags pointing to internal IPs or localhost.

Impact Analysis

Attackers can trigger GET requests on local services without credentials, though responses are not readable. This could lead to unauthorized actions on internal services, information leakage, or further exploitation of local network services.

Mitigation Strategies

Upgrade Vikunja to version 2.7.1 or later immediately. Block non-attachment images in editor and project description paths. Tighten CSP in Vikunja Desktop to restrict loopback and LAN image loads. Review existing content for malicious img tags and remove them.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123515. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...