- Comment insertion failed to bind cards to the authorized board (CWE-639).
- REST and DDP inserts now validate the card board; DDP identity rebinding is denied. Denials are summarized in Admin Panel Problems.
- More details
| CVE | Icon | Vulnerability name | Date | Responsible Security Disclosure by | Stars | Process | Vulnerabilities |
|---|---|---|---|---|---|---|---|
| - | CommentBoundaryBleed | 2026-09-14 | Wenhao Wu, Southeast University | |
Responsible disclosure through a saved GitHub security advisory; REST and DDP comment boundary paths reviewed during remediation. |
|
A comment-capable member could submit an authorized board ID with a foreign private card ID. REST and DDP inserted the inconsistent relation, which card-based comment subscriptions expose to the victim.
Both insert paths now validate the authoritative card board; DDP cannot rebind comment identities to bypass the insertion check. Blocked attempts are summarized in Problems and logging cannot break denial.
Source fix and regression coverage. REST-prefix, DDP-deny, boundary and server insert-inventory tests pass. Live browser execution remains pending; no CVE is assigned here.