CVE-2026-112289 in Koalixcrm
Summary
by MITRE • 10/19/2026
Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.link_to_task(). Attackers can embed HTML or script that executes when administrators open the task changelist or change form, enabling actions like creating a superuser.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in KoalixCRM versions through 1.14.0 represents a critical stored cross-site scripting flaw rooted in improper input validation and output encoding within the application's task management module. This specific weakness allows authenticated staff users, who possess elevated privileges but not necessarily administrative rights, to inject malicious client-side script payloads by manipulating the title field of tasks. The core technical failure lies in the rendering logic associated with the Task.link_to_task function, which fails to properly escape user-supplied data before it is rendered in the web page's HTML structure. Because the input is stored directly into the database without sanitization and subsequently retrieved and displayed without adequate encoding, the browser interprets the injected content as executable code rather than plain text when an administrator views the task list or edit forms.
From a technical perspective, this vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation known as cross-site scripting. The attack vector is particularly dangerous because it leverages stored persistence; unlike reflected XSS where the payload must be delivered via a link to each victim, here the malicious script resides on the server and executes automatically for any administrator who accesses the compromised task interface. This mechanism bypasses many client-side security controls that might otherwise detect or block transient injection attempts. The attacker exploits the trust relationship between the application's backend and its administrative users, turning routine operational activities like reviewing tasks into a vehicle for code execution within the context of the victim's session.
The operational impact of this vulnerability is severe due to the potential for complete system compromise through privilege escalation. Since the script executes in the browser with the privileges of the viewing administrator, an attacker can perform actions that are typically restricted to superusers or administrators. This includes creating new administrative accounts, modifying application configurations, accessing sensitive customer data, or executing arbitrary commands if other vulnerabilities exist within the same session context. The ability to create a superuser effectively grants the attacker permanent control over the KoalixCRM instance, allowing them to maintain persistent access even after their original credentials are discovered and revoked. This undermines the integrity of the entire application environment and exposes all stored data to unauthorized manipulation or exfiltration.
In terms of threat modeling, this scenario corresponds to ATT&CK technique T1059, specifically sub-techniques involving command scripting such as JavaScript execution within a browser context. The attack follows a pattern where initial access is gained through legitimate staff credentials, followed by exploitation of the stored XSS flaw to escalate privileges and establish persistence via new admin accounts. This progression highlights the risk associated with insufficient role-based access control enforcement in conjunction with input validation failures, allowing lower-privileged users to influence high-privilege workflows.
To mitigate this vulnerability, immediate remediation should focus on implementing strict output encoding for all dynamic content rendered by Task.link_to_task and related UI components. Developers must ensure that user-supplied data is escaped according to the context in which it is displayed, such as HTML entity encoding for body text or attribute escaping if used within tags. Additionally, input validation should be enforced at both the client and server levels to reject or sanitize potentially dangerous characters before storage. Deploying a Content Security Policy header can also help mitigate the impact by restricting the sources from which scripts are allowed to execute, thereby preventing the injection of external malicious payloads even if some script execution occurs. Regular security audits and penetration testing focused on stored XSS vectors are recommended to ensure that similar flaws do not exist elsewhere in the application logic.