{"id":"GHSA-8wvg-r2j4-3737","kind":"vulnerability","aliases":["GHSA-8wvg-r2j4-3737","GO-2026-6723"],"related":[],"title":"Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint in code.vikunja.io/api","description":"Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint in code.vikunja.io/api.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: code.vikunja.io/api before v2.6.0.","summary":"Vikunja's task assignees endpoint in the code.vikunja.io/api Go module returns assignee email addresses to users who only have read-only access to a project. An attacker with a read-only project membership can collect the email addresses of other users assigned to tasks in that project.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"code.vikunja.io/api","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","vikunja"],"not_affected_if":["no-read-only-members"],"how_to_check":"Check the Vikunja API module version: affected before v2.6.0.","fix":"Upgrade code.vikunja.io/api to v2.6.0 or later.","status":"open","published_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:26+00:00","updated_at":"2026-10-23T20:15:26+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T20:15:26Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade code.vikunja.io/api to v2.6.0 or later.","summary":"Vikunja's task assignees endpoint in the code.vikunja.io/api Go module returns assignee email addresses to users who only have read-only access to a project. An attacker with a read-only project membership can collect the email addresses of other users assigned to tasks in that project.","category":"package","who_cares":["vikunja","self-hosted","go"],"confidence":0.7,"analyst_note":"","how_to_check":"Check the Vikunja API module version: affected before v2.6.0.\nunknown","needs_analyst":false,"not_affected_if":["no-read-only-members"],"severity_if_unknown":"unknown"},"cost_usd":0.000563,"input_tokens":2110,"output_tokens":704,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':27A '-6723':28A '/api':20A,36A,52B,162C '/api.':113C '3737':25A,33A '8wvg':23A,31A 'access':67B 'addit':122C,154C 'address':4A,58B,84B,97C 'advisori':117C 'affect':155C 'assign':88B 'assigne':2A,15A,46B,56B,95C,108C 'attack':72B 'automat':128C 'caus':138C 'code.vikunja.io':19A,35A,51B,112C,161C 'code.vikunja.io/api':18A,34A,50B,160C 'code.vikunja.io/api.':111C 'collect':81B 'contain':121C 'could':125C 'disclos':5A,98C 'edit':149C 'email':3A,57B,83B,96C 'endpoint':16A,47B,109C 'fals':140C 'false-posit':139C 'ghsa':22A,30A 'ghsa-8wvg-r2j4':21A,29A 'go':26A,37B,53B,132C 'host':41B 'map':129C 'member':11A,104C 'membership':79B 'modul':54B,133C,156C 'note':114C 'packag':38B 'pleas':146C 'posit':141C 'project':10A,70B,78B,93B,103C 'r2j4':24A,32A 'read':8A,65B,76B,101C 'read-on':7A,64B,75B,100C 'report':120C,142C,152C 'return':55B 'scanner':145C 'self':40B 'self-host':39B 'sourc':116C 'standard':131C 'suggest':147C 'task':14A,45B,90B,107C 'user':60B,87B 'v2.6.0':164C 'version':123C,134C,158C 'via':12A,105C 'vikunja':1A,42B,43B,94C 'vulner':144C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6723","url":"https://pkg.go.dev/vuln/GO-2026-6723","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}