CVE-2026-112289: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in KoalixSwitzerland koalixcrm

CVE-2026-112289 is a stored cross-site scripting vulnerability in Koalixcrm through version 1.14.0. The vulnerability arises because task titles stored by staff users are rendered unescaped in the Task.link_to_task() method. This allows attackers to embed arbitrary HTML or JavaScript code that executes in the context of administrators viewing the task changelist or change form. Exploitation can lead to privilege escalation actions, including the creation of superuser accounts. The CVSS 4.0 base score is 5.1, indicating medium severity.

Attackers with staff user privileges can inject malicious scripts that execute when administrators access certain task views. This can lead to unauthorized actions such as privilege escalation by creating superuser accounts. The vulnerability compromises the integrity and security of administrative functions within Koalixcrm.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict staff user privileges to trusted users only and avoid opening task changelists or change forms from untrusted sources. Monitor vendor communications for patches addressing this vulnerability.