CVE-2026-123515 Vikunja before 2.7.1 Client-Side Request Forgery via Stored Rich-Text Images

Medium 5.1 Published 8 Nov 2026 Updated 12 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-123515?

CVE-2026-123515 is a medium-severity vulnerability in go-vikunja vikunja, published on 8 Nov 2026.

Official description

Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content.

Weakness: CWE-441

Which versions are affected by CVE-2026-123515?

How do I fix CVE-2026-123515?

No fix has been published for CVE-2026-123515 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-123515 being exploited?

There is no known exploitation of CVE-2026-123515 in the wild and no public exploit code.

Sources

Also known as GHSA-2f75-93c9-xf32, GHSA-v3ff-w4v5-fqw6.