Contents / ChecklistWriteBleed

CVE	Vulnerability name	Date	Responsible Security Disclosure by	Vulnerabilities
GHSA-5r4m-5xx6-96jf	ChecklistWriteBleed	2026-08-22	Char0n1507 and xet7 Coordinated disclosure with a working reproduction and root-cause analysis.	Read-only board members could create, edit and delete checklists and checklist items through REST (CWE-863 Incorrect Authorization) Affected WeKan v11.07 and earlier Severity: High; board-integrity impact within boards visible to the attacker Fixed at upcoming WeKan release

Details

ChecklistWriteBleed — read access was mistaken for write access (CWE-863)

Checklist and checklist-item mutation routes checked only whether the caller could view the board. An authenticated read-only member could therefore create, edit or delete checklist content.

Fix: every checklist and checklist-item mutation now requires the canonical board write capability. GET routes retain read access. Positive and negative regression tests pin the distinction.

Timeline	Details
2026-08-22	Report received from Char0n1507 through GitHub Security Advisory GHSA-5r4m-5xx6-96jf.
2026-08-22	Fixed for the upcoming WeKan release.