Hall of Fame image from https://openclipart.org/detail/120343/trophy
Back to Hall of Fame Contents Back to Wekan Website

Contents / ImpersonateBleed

CVE Vulnerability name Date Responsible Security Disclosure by Vulnerabilities
-

ImpersonateBleed

2026-07-19 meifukun (GitHub) and xet7 (fix)

Privately reported 8 issues reviewed against WeKan v9.95.0.
  • ImpersonateBleed — several board export endpoints (models/export.js, exportExcel.js, exportExcelCard.js, exportPDF.js) authorized export with canExport(user) || impersonateDone, where impersonateDone was merely the existence of ANY historical ImpersonatedUsers record for the user. A former admin who ever used impersonation kept permanent export access to any private board even after being demoted. Fixed by removing the impersonation bypass so export requires real board visibility (canExport) only (CWE-863 Incorrect Authorization)
  • Reported privately by meifukun (https://github.com/meifukun)
  • Fixed at upcoming WeKan release
  • More details


Details

ImpersonateBleed — CWE-863 Incorrect Authorization

several board export endpoints (models/export.js, exportExcel.js, exportExcelCard.js, exportPDF.js) authorized export with canExport(user) || impersonateDone, where impersonateDone was merely the existence of ANY historical ImpersonatedUsers record for the user. A former admin who ever used impersonation kept permanent export access to any private board even after being demoted. Fixed by removing the impersonation bypass so export requires real board visibility (canExport) only.

Reported privately by meifukun (https://github.com/meifukun), who reviewed 8 issues against WeKan v9.95.0 (commit f602b9459fa1622f60ee8c3b639f02035f3ab32b) on local self-hosted instances only. Fixed at the upcoming WeKan release.