HTML Injection Vulnerability in Vikunja by Go-Vikunja

CVE-2026-115507

What is CVE-2026-115507?

Vikunja versions 2.2.0 through 2.7.0 are susceptible to an HTML injection vulnerability that allows authenticated users to insert malicious content in email notifications. Specifically, the flaw exists within the CreateConversationalHeader function in the notifications mail handler, where raw display names and project titles can be injected. This enables attackers to craft notifications containing phishing links, jeopardizing the security of project members who receive these emails. To mitigate this risk, users are advised to upgrade to version 2.7.1 or later.

References