Is CVE-2026-123515 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123515 being exploited in the wild.

How severe is CVE-2026-123515?

Medium severity, with a CVSS score of 4.1, published 8 November 2026.

Is there a fix for CVE-2026-123515?

Yes: fixed in 2.7.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123515 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-123515?

Check whether you run Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123515: Vikunja client-side request forgery in rich-text images

CVE-2026-123515 · Severity: medium · CVSS 4.1 · Published 2026-11-08

Vikunja is a task and project management platform. A user with write access can embed malicious images in tasks, comments, or project descriptions that force other users' browsers to make requests to internal services on their local network or computer when they view the content. This could be exploited to trigger actions on local services or gather information about when content is viewed.

Technologies: Vikunja. Vendors: Vikunja.

Quick answers

Is CVE-2026-123515 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123515 being exploited in the wild.
How severe is CVE-2026-123515?: Medium severity, with a CVSS score of 4.1, published 8 November 2026.
Which products and versions are affected?: Vikunja before 2.7.1.
Is there a fix for CVE-2026-123515?: Yes: fixed in 2.7.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123515 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-123515?: Check whether you run Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.7.1

Technical details

A client-side request forgery vulnerability exists in Vikunja's rich-text editor, which fails to block or proxy image URLs pointing to loopback or private network addresses. An attacker with write access stores img elements with src attributes targeting 127.0.0.1 or LAN addresses; when viewers open the content, their browsers automatically issue blind GET requests to those addresses. Desktop installations are particularly affected due to permissive Content Security Policy rules on the loopback origin.

Affected products

Vikunja Vikunja before 2.7.1

Timeline

2026-10-22: disclosed
2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.