GHSA-8wvg-r2j4-3737: Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint

October 9, 2026

TaskAssginee.ReadAll returns assignee user objects without blanking the Email field, disclosing assignee email addresses to any read-only project member. Every sibling path that returns user objects obfuscates the email; this one does not.

References

github.com/advisories/GHSA-8wvg-r2j4-3737
github.com/go-vikunja/vikunja/pull/3688
github.com/go-vikunja/vikunja/releases/tag/v2.6.0
github.com/go-vikunja/vikunja/security/advisories/GHSA-8wvg-r2j4-3737

Code Behaviors & Features

Detect and mitigate GHSA-8wvg-r2j4-3737 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →