Expected
When a project is shared with public teams, members of those teams should be available in the assignee picker to other project members, including members of a different public team that also has access to the project.
Actual
After upgrading to Vikunja 2.6.0, a user who belongs only to one of the public teams cannot see members of the other public team in the assignee picker.
A user becomes visible to all project members when they receive a direct user share on the project. Alternatively, if the current user and a previously invisible user are placed in a common team, that user becomes visible only to members of that common team.
The public-team setting does not appear to affect this behaviour. Public teams are enabled instance-wide, and both teams are marked public.
Reproduction
- Enable public teams on a self-hosted instance.
- Create two public teams, A and B, with different members.
- Share one project with both teams.
- Sign in as a user who belongs only to team A.
- Open a task in that project and try to select an assignee.
Result: members of team B are not offered as assignees.
Environment
- Vikunja 2.6.0
- Self-hosted
- Official apt package
- PostgreSQL 18.4
Possible cause
This seems related to GHSA-39p5-2wrr-xh29. The 2.6.0 changelog says: “The project’s user list no longer leaks people whose only access comes through an invisible team either.”
That security fix is important. However, it may also make public teams ineffective for assigning tasks across multiple teams sharing the same project. Is this the intended behaviour for public teams, or should members of a public team remain available as assignees to other users who have access to the same project?