Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, published 9 October 2026.

Which products and versions are affected?

code.vikunja.io/api (Go) <= 2.5.0.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Vikunja task assignees endpoint email disclosure to read-only members

Q: Is there a fix for This vulnerability?

No fixed version is recorded yet. Upgrade to a patched version. As a workaround, restrict read-only project membership to users who should have access to assignee email addresses, or disable the task assignees endpoint if not needed. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is This vulnerability attacked?

It is attacked over the network, in a web application.

Q: Am I affected?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · Published 2026-10-09

Vikunja is a task and project management application. A flaw in the task assignees API endpoint causes assignee email addresses to be leaked to read-only project members who should only be able to see usernames. This disclosure occurs when querying the list of people assigned to a task.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, published 9 October 2026.
Which products and versions are affected?: code.vikunja.io/api (Go) <= 2.5.0.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Upgrade to a patched version. As a workaround, restrict read-only project membership to users who should have access to assignee email addresses, or disable the task assignees endpoint if not needed. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Upgrade to a patched version. As a workaround, restrict read-only project membership to users who should have access to assignee email addresses, or disable the task assignees endpoint if not needed.

Technical details

The TaskAssignee.ReadAll method in pkg/models/task_assignees.go selects and returns full user objects including the unobfuscated Email field, whereas sibling endpoints properly blank this field before serialization. The endpoint correctly gates on task.CanRead permissions but fails to sanitize the email disclosure for read-only users. The vulnerability affects both API v1 and v2, which route through the same model method.

Affected products

Vikunja Vikunja

Timeline

2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.