Koalixcrm releases up to version 1.14.0 allow task titles to be stored without escaping and later rendered by the Django Admin through Task.link_to_task(). This stored cross‑site scripting flaw (CWE‑79) enables any staff user to inject malicious HTML or JavaScript that executes when an administrator visits the task changelist or edit form. Because the script runs in the administrator’s session, an attacker could perform arbitrary actions such as creating a superuser or modifying sensitive data.

KoalixSwitzerland’s Koalixcrm product, all releases through version 1.14.0. No specific patch version is listed in the data, so any deployment of 1.14.0 or earlier is vulnerable.

The CVSS score of 5.1 indicates moderate severity; the EPSS score is not available and KEV does not list this vulnerability. Exploitation requires an authenticated staff account that can enter task titles, and the attacker must then provoke an administrator to view the affected page. Once the injected script executes in admin context, it can compromise the application and elevate privileges, but the attack vector is constrained to users with staff or higher permissions.