Vikunja EUVD-2026-108339

Requires an authenticated Vikunja account (PR:L) that can set attacker-controlled text that reaches the conversational email header: a task title, project title, or the commenter's own display name. The attacker must also share a project with the victim and trigger a task-comment or task-mention notification (e.g. by commenting with an @mention or assigning the victim) so Vikunja emails other project members. The technical enabler is that the header passes these strings raw into an existing <a href> element and then sanitizes with bluemonday UGCPolicy, which deliberately preserves http/https anchors (only adding rel="nofollow"), allowing an anchor-breakout phishing link; an injected <img> is neutralized because RewriteSrc blanks non-data: sources, so no tracking pixel. LIMITING FACTORS: no script execution is possible (not a true XSS), impact is confined to a phishing link; the victim must click it (UI:P), must use an HTML-rendering email client, and the attacker must already have project membership. Affects versions 2.2.0 up to but not including 2.7.1.

This is a genuine but low-to-moderate priority issue, not an inflated high-severity bug. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N, 5.1 Medium) is internally consistent with the mechanism: a network-reachable but authenticated attacker (PR:L - must hold a Vikunja account and be a member of a shared project) injects an HTML anchor whose only impact is limited integrity (VI:L, a phishing link in a notification email), with no confidentiality or availability impact and no scope change to other systems. Exploitation is passive-user-interaction dependent (UI:P): a victim must actually click the injected phishing link for harm to occur. No CISA KEV listing is present and no EPSS score was supplied, so there is no signal of active or widespread exploitation; the vuln.today decision label is 'this_month', consistent with a patch-on-normal-cadence item rather than an emergency. A detailed, end-to-end working reproduction exists inside the vendor GHSA advisory (tested on v2.6.0), which raises practical exploitability above a purely theoretical finding. Notably this is an explicitly incomplete fix of the earlier GHSA-45q4-x4r9-8fqj / CVE-2026-35600, where the vendor wrongly assumed bluemonday's raw-HTML sanitization of the conversational header was sufficient. The signals align rather than conflict: moderate CVSS, no KEV, no EPSS, PoC present, routine patch cadence - treat as a standard scheduled remediation.

An authenticated attacker who is a member of a shared Vikunja project creates a task whose title is '</a><a href="https://evil.example/phish">Verify your account</a>' (or sets a malicious display name), then comments to mention or assigns a victim project member. Vikunja emails that member a task-comment/task-mention notification whose conversational header interpolates the title raw inside an existing anchor, so the payload breaks out and renders a clickable attacker-controlled phishing link. A detailed working reproduction is published in the vendor GHSA advisory; harm requires the recipient to click the injected link (UI:P).