A client‑side request forgery vulnerability in Vikunja prior to version 2.7.1 allows a user with write permissions to embed malicious <img> tags in rich‑text fields such as tasks, comments, project descriptions, or Markdown imports. When a victim opens the stored content, the victim’s browser automatically performs GET requests to the specified URL. The requests can target loopback or local network addresses, causing the client to interface with internal services without the victim’s knowledge. This can expose information about internal endpoints or trigger actions on local systems, potentially assisting in reconnaissance or lateral attacks. The weakness is classified under CWE‑441.

Vikunja web application version 2.7.0 and earlier gains access to task, comment, project description, and imported Markdown rich‑text editing features. No specific operating system or environment limits are noted; the flaw applies to any deployment using these content types before the 2.7.1 update.

The CVSS score of 5.1 indicates a moderate impact. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have write access to create or modify content and requires victims to view the content. The attack vector is client‑side, so no network-level access is required for the attacker. While exploitation conditions are modest, the potential to discover internal services could justify monitoring of client activity and encouraging use of a newer version.