Activity and comment APIs expose other users' email addresses to project members (getMyActivityStream/getProjectActivity/getProjectActivities/getComment/getAllComments)

Environment

Kanboard v1.2.53 (Docker image kanboard/kanboard:v1.2.53), JSON-RPC API (POST /jsonrpc.php, HTTP Basic auth).

Summary

Several read APIs serialize the email address (and avatar_path) of other users into responses visible to any project member, although no member-visible interface exposes email addresses:

• getMyActivityStream, getProjectActivity, getProjectActivities: every activity event includes email of the user who triggered the event (source: ProjectActivityModel::getQuery(), app/Model/ProjectActivityModel.php:58-60 joins uc.email, uc.avatar_path).
• getComment, getAllComments: every comment row includes email of the comment author (source: CommentModel::getById() app/Model/CommentModel.php:103-121 and getAll() :72-92 join users.email, users.avatar_path).

Verified empirically on v1.2.53: a regular project member receives the project owner's email address in these responses.

For reference, no member-visible path exposes emails otherwise: web activity templates render author name/avatar only, getAssignableUsers/getProjectUsers return display names, and getUser is admin-only.

Steps to reproduce

Two regular users, owner and peer, sharing one private project (peer added as project-member):

1. As owner: createTask(project_id=1, title="poc") (this logs a task.create activity event).
2. As peer: getAssignableUsers(project_id=1) -> display names only (no emails).
3. As peer: getProjectActivity(project_id=1) -> the event object contains "email": "<owner's real email address>".
4. As peer: getMyActivityStream -> same field on every event.
5. As owner: createComment(task_id=1, user_id=<owner_id>, content="hello").
6. As peer: getComment(comment_id=1) and getAllComments(task_id=1) -> rows contain "email": "<owner's email>" and avatar_path.

Example request for step 3:

POST /jsonrpc.php
Authorization: Basic <peer credentials>

{"jsonrpc":"2.0","method":"getProjectActivity","params":{"project_id":1},"id":1}

Impact

Information exposure / privacy (CWE-201, CWE-359). Any authenticated project member learns the email address of every user who acts on (or comments in) their projects, including managers and administrators acting there. Read-only; severity limited to the co-project scope. CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (3.1, Low).

Suggested fix

Drop users.email (and avatar_path if unused) from the two model queries, or unset those keys in the API formatters before serialization.