Koalix CRM CVE-2026-112289

Requires an authenticated staff-level account in Koalix CRM (through 1.14.0) with permission to create or edit tasks, so the attacker must already be an insider or have compromised staff credentials. The injected payload is inert until an administrator opens the task changelist or task change form in the Django admin - this required admin interaction (UI:P) is the primary limiting factor. Exploitation is confined to deployments exposing the Django admin task views and does not affect anonymous or read-only users; there is no path for unauthenticated remote triggering.

This is a medium-severity stored XSS (CVSS 4.0 base 5.1) that should be treated as a low-to-moderate real-world priority rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) shows that while the attack is network-deliverable with low complexity, it explicitly requires existing privileges (PR:L - a staff-level account) and passive victim interaction (UI:P - an administrator must open the affected task view). This is therefore a privilege-escalation path for an already-trusted insider, not a path for anonymous internet attackers. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the finding originates from a VulnCheck advisory and a GitHub issue rather than incident reporting. The limited-but-non-zero integrity/confidentiality impact plus the plausible superuser-creation escalation keeps it worth patching, but the authentication precondition and reliance on admin interaction substantially constrain practical risk. No signals conflict; the main gap is the absence of exploitation-probability data (EPSS) and any POC confirmation.

A low-privileged staff user with access to the Koalix CRM task module creates or edits a task whose title contains a malicious script payload. Because Task.link_to_task() renders the title unescaped, the script executes in the browser of any administrator who later opens the task changelist or change form in the Django admin, running in that admin's authenticated session. No public POC is referenced, but the attacker could use the executed script to perform admin-level actions such as creating a new superuser account.