Vikunja before version 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS through unsanitized table‑cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full‑viewport phishing overlays or to force zero‑click outbound background‑image requests that deanonymize viewers.

The affected product is Vikunja, maintained by go‑vikunja. Any deployment running a version earlier than 2.7.1 is vulnerable. Versions 2.7.1 and later contain the fix.

The CVSS score of 5.1 indicates moderate severity, and the vulnerability is not yet catalogued in CISA KEV. The EPSS score is not available, so the current exploitation probability is unknown. Because the flaw requires only project write access, which many users possess, an attacker who can authenticate and has write permissions can inject malicious CSS. This can lead to phishing overlays that trick users into submitting credentials and background image requests that reveal viewer information, posing a notable privacy risk.