{"schema":"threatline.record/2","record":{"id":"GHSA-8wvg-r2j4-3737","aliases":["GHSA-8wvg-r2j4-3737","GO-2026-6723"],"summary":"Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint","details":"### Summary\n`TaskAssginee.ReadAll` returns assignee user objects without blanking the `Email` field, disclosing assignee email addresses to any read-only project member. Every sibling path that returns user objects obfuscates the email; this one does not.\n\n### Details\n`pkg/models/task_assignees.go` (~lines 306-344) does `Select(\"users.*\")` and returns the result directly. `User.Email` is `json:\"email,omitempty\"`, so a non-empty value always serializes. The endpoint gates on `task.CanRead`, so a read-only member passes. Sibling paths blank the field: `pkg/models/tasks.go:530`, `pkg/models/project_users.go:216`, `pkg/models/teams.go:177`, `pkg/models/label_task.go:312`, `pkg/models/task_attachment.go:511`. The omission here reads as an oversight, not a decision.\n\nThe same file's `getRawTaskAssigneesForTasks` (~line 56) also selects `users.*` but is safe because its only caller (`addAssigneesToTasks`) blanks the email afterwards.\n\n### PoC (verified at runtime against v2.5.0, v1 and v2)\n```\nGET /api/v1/tasks/{id}/assignees   (reader with permission:0)\n-> [{\"id\":37,\"username\":\"...\",\"email\":\"assignee+SECRET@example.test\", ...}]\n```\nSame leak on `GET /api/v2/tasks/{id}/assignees` (routes through the identical model method). Contrast: `GET /api/v1/projects/{id}/projectusers` and the project task-embed both return the same users with no email.\n\n### Impact\nDisclosure of assignees' email addresses to users who should only see usernames. Read-only.\n\n### Fix\nBlank `Email` on each returned user in `TaskAssginee.ReadAll` before returning, matching the sibling paths. Covers v1 and v2 at once.","categories":["Libraries & packages"],"product":"code.vikunja.io/api","vendor":"","ecosystem":"go","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-8wvg-r2j4-3737","source_modified_at":"2026-10-09T20:54:51Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"code.vikunja.io/api"},"range":"<= 2.5.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8wvg-r2j4-3737","source_modified_at":"2026-10-19T21:41:23.405165570Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"code.vikunja.io/api","ecosystem":"Go","purl":"pkg:golang/code.vikunja.io/api"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-8wvg-r2j4-3737","source_modified_at":"2026-10-09T20:54:51Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"code.vikunja.io/api"},"version":"2.6.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8wvg-r2j4-3737","source_modified_at":"2026-10-19T21:41:23.405165570Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"code.vikunja.io/api","ecosystem":"Go","purl":"pkg:golang/code.vikunja.io/api"},"version":"2.6.0"}],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-09T20:54:49Z","modified_at":"2026-10-19T21:41:23.405165570Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-8wvg-r2j4-3737","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-09T20:54:51Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-8wvg-r2j4-3737","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-19T21:41:23.405165570Z"}],"sources":["GitHub Advisory Database","OSV"],"references":[{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8wvg-r2j4-3737","source":"GitHub Advisory Database"},{"url":"https://github.com/go-vikunja/vikunja/pull/3688","source":"GitHub Advisory Database"},{"url":"https://github.com/go-vikunja/vikunja/releases/tag/v2.6.0","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-8wvg-r2j4-3737","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T21:41:23.405165570Z","content_hash":"2ca193ed3a3211f83e2bf9846bc5c7c975938d487aae223bb2baa65ae4dbaafb"}}