CVE-2026-112289: Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-19 · updated 2026-10-19
Weakness: CWE-79

Description

Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.link_to_task(). Attackers can embed HTML or script that executes when administrators open the task changelist or change form, enabling actions like creating a superuser.

Affected products

KoalixSwitzerland koalixcrm: through 1.14.0

References

https://github.com/KoalixSwitzerland/koalixcrm/blob/1.14.0/koalixcrm/crm/reporting/task.py
https://github.com/KoalixSwitzerland/koalixcrm/issues/444
https://www.vulncheck.com/advisories/koalixcrm-through-1.14.0-stored-xss-via-task-title-in-django-admin
https://github.com/KoalixSwitzerland/koalixcrm/issues/444

Get alerted when CVE-2026-112289 or the next vulnerability affects your stack