Live › vulnerability › GHSA-8wvg-r2j4-3737
Go to dashboardVikunja's task assignees endpoint in the code.vikunja.io/api Go module returns assignee email addresses to users who only have read-only access to a project. An attacker with a read-only project membership can collect the email addresses of other users assigned to tasks in that project.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| code.vikunja.io/api | go | all versions | – |
Check the Vikunja API module version: affected before v2.6.0.
Upgrade code.vikunja.io/api to v2.6.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint in code.vikunja.io/api.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: code.vikunja.io/api before v2.6.0.
This page as .md · .json · in your agent: get_signal("GHSA-8wvg-r2j4-3737")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.