MEDIUM 5.1 NVD
CVE-2026-123515
Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients request loopback or LAN a
Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content.
References
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2f75-93c9-xf32
- https://www.vulncheck.com/advisories/vikunja-before-2.7.1-client-side-request-forgery-via-
This medium severity vulnerability with a CVSS score of 5.1 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.