Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint

Summary TaskAssginee.ReadAll returns assignee user objects without blanking the Email field, disclosing assignee email addresses to any read-only project member. Every sibling path that returns user objects obfuscates the email; this one does not. Details pkg/models/taskassignees.go lines 306-344...

GHSA-8WVG-R2J4-3737 Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint

Summary TaskAssginee.ReadAll returns assignee user objects without blanking the Email field, disclosing assignee email addresses to any read-only project member. Every sibling path that returns user objects obfuscates the email; this one does not. Details pkg/models/taskassignees.go lines 306-344...

PT-2026-117999

Summary TaskAssginee.ReadAll returns assignee user objects without blanking the Email field, disclosing assignee email addresses to any read-only project member. Every sibling path that returns user objects obfuscates the email; this one does not. Details pkg/models/task assignees.go lines 306-34...