---
id: GO-2026-6723
aliases:
  - GHSA-8wvg-r2j4-3737
title: >-
  Vikunja: Assignee email addresses disclosed to read-only project members via
  the task assignees endpoint in code.vikunja.io/api
summary: >-
  Vikunja: Assignee email addresses disclosed to read-only project members via
  the task assignees endpoint in code.vikunja.io/api
severity: none
vendor: api
product: code.vikunja.io/api
ecosystem: go
affected:
  - code.vikunja.io/api
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T21:31:36.963583258Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6723'
references:
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8wvg-r2j4-3737
  - url: 'https://github.com/go-vikunja/vikunja/pull/3688'
  - url: 'https://github.com/go-vikunja/vikunja/releases/tag/v2.6.0'
tags:
  - osv
  - go
ingestedAt: '2026-10-21T11:54:42.766Z'
---

## Overview

Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api before v2.6.0.

## Affected packages

- `code.vikunja.io/api`

## Remediation

Refer to the advisory for the patched release.