DirectoryInfoBleed

CVE	Icon	Vulnerability name	Date	Responsible Security Disclosure by	Stars	Process	Vulnerabilities
-		DirectoryInfoBleed	2026-10-02	xet7		Found while auditing publications sent before sign-in after the 2026-10-02 Hall of Fame review; fixed by xet7.	The setting publication, which every visitor subscribes to before signing in, carried the Admin Panel LDAP settings: host, port, base DN, the bind account's DN, the search filter and the encryption mode. Those fields now go to site admins only. CWE-200. Medium severity: it tells anyone where the directory is and which account binds to it, not the password. No CVE assigned. Fix prepared locally for the Upcoming release; not yet released.

Details

The sign-in page needs a few settings before anyone has signed in - which login methods are on, the product name - and gets them from the setting publication. That publication also carried the LDAP configuration from Admin Panel: the directory host and port, the base DN, the DN of the account WeKan binds as, the search filter and whether the connection is encrypted.

None of that is needed to sign in, and it maps the organisation's directory for anyone who opens the login page.

Fix

The LDAP host, port, base DN, bind DN, search filter and encryption mode are published to site admins only, through the same per-viewer field set on both publishing paths.

Detection

None. The fix changes what a response carries; every visitor of the login page subscribes, so there is no attempt to record in Admin Panel → Problems.

Verification

Unit tests in tests/settingLdapPublication.test.cjs check that the directory server details are admin-only and that both publishing paths use the per-viewer field set. The unit tests pass in the WeKan repository. There is no browser test.

Source fix and regression tests