ArchiveBleed
| CVE | Icon | Vulnerability name | Date | Responsible Security Disclosure by | Stars | Process | Vulnerabilities |
|---|---|---|---|---|---|---|---|
| - | ArchiveBleed | 2026-10-02 | xet7 |  |
Found while auditing Sandstorm board import and clone after the 2026-10-02 Hall of Fame review; fixed by xet7. | On Sandstorm, Only a board the caller administers is replaced. CWE-639. Medium severity, Sandstorm only. No CVE assigned. Fix prepared locally for the Upcoming release; not yet released. |
Details
A Sandstorm grain holds one board, so importing or cloning a board there replaces the current one: the creators archive the board named as currentBoard and put the new one in its place. importBoard and cloneBoard took that id from the client and passed it on.
Nothing checked that the id was the caller's own board, or that the caller administered it, so any user could archive any board by naming it in an import.
Fix
The current board is replaced only when the caller is an admin of it. Every creator call in the import methods passes a checked board id.
Detection
None. A member who is not an admin reaches this by importing from a board page, which is ordinary use, so a refusal is not an attempt to record in Admin Panel → Problems.
Verification
Unit tests in tests/sandstormReplaceBoard.test.cjs reproduce the reported shape - naming someone else's board - and the negative test fails on any creator.create in the import methods that passes an unchecked board id. The unit tests pass in the WeKan repository. It was not tested inside Sandstorm.