Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123529Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color
Medium 4.6
In plain English
A medium-severity security flaw in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)4.6Medium
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport phishing overlays or force zero-click outbound background-image requests that deanonymize viewers.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 0 – before 2.7.1 |
Weakness: CWE-1021 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N