---
id: GO-2026-6714
aliases:
  - GHSA-3hc7-r24j-rpwc
title: >-
  Vikunja: Cross-project task disclosure through subtask expansion in
  code.vikunja.io/api
summary: >-
  Vikunja: Cross-project task disclosure through subtask expansion in
  code.vikunja.io/api
severity: none
vendor: api
product: code.vikunja.io/api
ecosystem: go
affected:
  - code.vikunja.io/api
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T21:31:49.921503534Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6714'
references:
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-3hc7-r24j-rpwc
  - url: >-
      https://github.com/go-vikunja/vikunja/commit/077dc4de79ce6f1ab59215a2c7bf9b30423685f2
  - url: 'https://github.com/go-vikunja/vikunja/pull/3688'
  - url: 'https://github.com/go-vikunja/vikunja/releases/tag/v2.6.0'
tags:
  - osv
  - go
ingestedAt: '2026-10-21T11:54:42.766Z'
---

## Overview

Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api before v2.6.0.

## Affected packages

- `code.vikunja.io/api`

## Remediation

Refer to the advisory for the patched release.