CVE-2026-123515

Vikunja versions before 2.7.1 are vulnerable to a client-side request forgery vulnerability. This issue stems from the application's handling of stored rich-text images , where users with write access can plant img elements in tasks, comments, project descriptions, or imported Markdown. These ele...