| CVE | Vulnerability name | Date | Responsible Security Disclosure by | Vulnerabilities |
|---|---|---|---|---|
| GHSA-f396-42fx-vr88 | AssignedBleed |
2026-08-21 |
Char0n1507 and
xet7
Coordinated disclosure with a working reproduction and root-cause analysis. |
|
The shared REST helper Authentication.checkBoardWriteAccess()
decided write access with a handwritten list of excluded member flags. It
excluded Comment Only, Worker and both read-only roles, but omitted
isCommentAssignedOnly. The canonical board-role table gives
Only Assigned Comment write: false, yet every mutation route
using the REST helper treated that member as a writer.
The issue was reproduced against WeKan v11.06 by having an authenticated
Only Assigned Comment member send PUT
/api/boards/:boardId/lists/:listId/cards/:cardId for an unassigned
card. The endpoint returned HTTP 200 and persisted the supplied title. A
Comment Only member was correctly refused as a control.
Fix: the shared REST helper now calls
allowIsBoardMemberWithWriteAccess(), the same canonical
capability decision used by DDP permissions and the client. This protects
every card mutation route and every other REST write route using the helper.
Both parallel attachment API implementations now use it as well.
Comment Only, Only Assigned Comment, Worker, Read Only and Only Assigned Read are denied. Board Admin, Normal, Normal Assigned Only and No Comments retain access. Denied attempts are rate-limited, attributed and visible in Admin Panel → Problems under AssignedBleed.
| Timeline | Details |
|---|---|
| 2026-08-21 | Report received from Char0n1507 through GitHub Security Advisory GHSA-f396-42fx-vr88. |
| 2026-08-21 | Fixed for the upcoming WeKan release. |