| CVE | Vulnerability name | Date | Responsible Security Disclosure by | Vulnerabilities |
|---|---|---|---|---|
| GHSA-fpm6-r5fg-2mrg | CalendarBleed |
2026-08-21 |
Char0n1507 and
xet7
Coordinated disclosure with a working reproduction and suggested remediation. |
|
The authenticated Meteor/DDP method importIcsToBoard(boardId, listId,
swimlaneId, icsText) turns iCalendar events into cards. It verified
board visibility and membership, then rejected only members for whom
Board.hasReadOnly() returned true. Comment Only, Only Assigned
Comment and Worker are non-writing roles but are not read-only flags, so they
passed that check and reached card insertion.
A Comment Only member reproduced the issue against WeKan v11.06 by invoking the method through a normal authenticated browser DDP session. A one-event calendar created a real card on the board and returned its id. The impact is unauthorized content injection inside a board the caller already belongs to; the report found no cross-board access, confidentiality loss or administrator escalation.
Fix: the DDP method now calls
allowIsBoardMemberWithWriteAccess(), the canonical role-capability
decision already used by the REST ICS endpoint. Comment Only, Only Assigned
Comment, Worker, Read Only and Only Assigned Read are refused. Board Admin,
Normal, Normal Assigned Only and No Comments retain import access because the
role table grants them the write capability.
Regression tests verify the shared authorization is applied before import,
cover every denied and allowed role, and prevent the bespoke membership or
hasReadOnly() checks from returning. Denied attempts are
rate-limited, attributed and visible in Admin Panel → Problems under
CalendarBleed.
| Timeline | Details |
|---|---|
| 2026-08-21 | Report received from Char0n1507 through GitHub Security Advisory GHSA-fpm6-r5fg-2mrg. |
| 2026-08-21 | Fixed for the upcoming WeKan release. |