Stored Cross-Site Scripting in KoalixCRM by Koalix Switzerland
CVE-2026-112289

5.1MEDIUM

Key Information:

Vendor

Koalixswitzerland

Status
Koalixcrm
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112289?

KoalixCRM versions up to 1.14.0 contain a vulnerability that allows attackers to inject malicious scripts via task titles. This stored cross-site scripting (XSS) flaw occurs when unescaped task titles are rendered in the Django admin interface. When an administrator accesses the task changelist or change form, the embedded script could execute, potentially allowing attackers to elevate privileges, such as creating a superuser account. Proper sanitization of user inputs in task titles is essential to mitigate this risk.

Affected Version(s)

koalixcrm 0 <= 1.14.0

References

https://github.com/KoalixSwitzerland/koalixcrm/issues/444
issue-tracking
https://github.com/KoalixSwitzerland/koalixcrm/blob/1.14....
technical-description
https://www.vulncheck.com/advisories/koalixcrm-through-1....
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aaron Amran Bin Amiruddin (@aaronamran)
.