BackgroundBleed
| CVE | Icon | Vulnerability name | Date | Responsible Security Disclosure by | Stars | Process | Vulnerabilities |
|---|---|---|---|---|---|---|---|
| - | BackgroundBleed | 2026-10-02 | xet7 |  |
Found while auditing board background downloads after the 2026-10-02 Hall of Fame review; fixed by xet7. | The board background download - REST Only a live attachment of the same board is served as its background, and setting CWE-639. High severity: any registered user, with an attachment id. No CVE assigned. Fix prepared locally for the Upcoming release; not yet released. |
Details
A board's background image is one of its attachments, named by the board's backgroundImageId. Both download paths - REST /api/attachment/download-background/:boardId and the api.board.downloadBackground method - checked that the caller was a member of the board in the URL and then served whichever attachment the field named, without asking which board that attachment belonged to.
A board admin may change the field, and anyone becomes a board admin by creating a board. So a user who learned the id of an attachment on another board - from a link, a notification, an old export - could create a board, set its background to that id, and download the file through their own board.
Fix
Both download paths serve the background only when the named attachment is live and belongs to the same board. A Boards deny rule refuses setting backgroundImageId to anything but an attachment of that board. A follow-up commit restored models/lib/boardBackground.js, which the first commit had overwritten.
Detection
Setting a background that is not one of the board's own attachments is refused and summarized as BackgroundBleed in Admin Panel → Problems (catalog key authz.background).
Verification
Unit tests in tests/backgroundBleed.test.cjs reproduce the reported attack with another board's attachment, check that both download paths and the field write ask the same rule and record an attempt, and the negative test fails on anything in the server that serves a backgroundImageId without checking it. The browser test tests/playwright/specs/background-bleed.e2e.js tries the attack from a signed-in client. The unit tests pass in the WeKan repository. The browser test was not run for this page.