HookUrlBleed
| CVE | Icon | Vulnerability name | Date | Responsible Security Disclosure by | Stars | Process | Vulnerabilities |
|---|---|---|---|---|---|---|---|
| - | HookUrlBleed | 2026-10-02 | xet7 |  |
Found while auditing the board publication after the 2026-10-02 Hall of Fame review; fixed by xet7. | The board publication sent every integration of the board, URL included, to everyone who could read the board: read-only members, and on a public board anonymous visitors. A chat incoming-webhook URL carries its secret in its path, so reading a board was enough to post as its integration. Only board admins receive the URLs. Others get the board, enabled state and activities, and the card-opened notification finds the integration by its id. CWE-200, CWE-522. High severity on public boards with an integration. No CVE assigned. Fix prepared locally for the Upcoming release; not yet released. |
Details
The board publication includes the board's integrations so the client can show the webhook settings and send the card-opened notification. It sent each integration whole to everyone who could read the board - read-only members, and anonymous visitors of a public board.
Slack, Mattermost, Rocket.Chat and most chat services identify an incoming webhook by a secret in its URL path, so anyone who saw the URL could post to that channel as the integration.
Fix
Only board admins, who manage the integrations, receive their URLs. Everyone else gets boardId, enabled and activities, and outgoingWebhooks finds the integration by its _id instead of needing the URL from the client.
Detection
None. The fix changes what a publication sends; reading a board is ordinary use, so there is no attempt to record in Admin Panel → Problems.
Verification
Unit tests in tests/webhookUrlPublication.test.cjs check that only the board's admins receive the URL, that the card-opened hook still works from the _id alone, and the negative test fails on any publication that sends integrations with their URL to non-admins. The unit tests pass in the WeKan repository. There is no browser test.