Contents / ErrorBleed

CVE	Vulnerability name	Date	Responsible Security Disclosure by	Vulnerabilities
GHSA-h59p-76c3-8345	ErrorBleed	2026-08-22	Char0n1507 and xet7 Coordinated disclosure with a working reproduction and root-cause analysis.	REST failures returned raw Error objects with HTTP 200, exposing implementation details and masking failure (CWE-209) Affected WeKan v11.07 and earlier Severity: Moderate; information-disclosure and API-integrity impact Fixed at upcoming WeKan release

Details

ErrorBleed — raw server errors were returned as successful REST responses (CWE-209)

Board and user handlers returned caught Error objects without an HTTP status, so the response defaulted to 200 and could expose internal messages and paths.

Fix: shared response handling preserves expected 4xx statuses and public reasons while replacing unexpected 5xx details with a generic message. Server diagnostics remain in server-side logs.

Timeline	Details
2026-08-22	Report received from Char0n1507 through GitHub Security Advisory GHSA-h59p-76c3-8345.
2026-08-22	Fixed for the upcoming WeKan release.