Contents / ImportBleed

CVE	Vulnerability name	Date	Responsible Security Disclosure by	Vulnerabilities
GHSA-qp32-wqxw-wq3h	ImportBleed	2026-08-23	Char0n1507 and xet7 Coordinated disclosure with a working reproduction and full write-chain analysis.	A logged-out DDP client could import board data and placeholder users directly into the database (CWE-306 Missing Authentication for Critical Function) Affected WeKan v11.09 and earlier Severity: Critical; unauthenticated integrity and availability impact across a shared instance Fixed at upcoming WeKan release

Details

ImportBleed — board import accepted a connection with no identity (CWE-306)

The importBoard Meteor method checked its arguments and the import feature switch, but never required this.userId. A network client with no account, login token or session could therefore reach import creators whose server-side work writes boards, lists, swimlanes, cards, activities and placeholder users directly to MongoDB.

Fix: importBoard and its importScoped sibling now complete Meteor’s mandatory type checks, then reject logged-out callers before feature checks, parsers or creators can run. Scoped imports also carry the authenticated method user explicitly into the writer. Denied attempts are attributed by connection address and grouped as ImportBleed in Admin Panel / Problems. Source-level and logged-out browser regression tests pin both the early guards and the no-write outcome.

Timeline	Details
2026-08-23	Report received from Char0n1507 through GitHub Security Advisory GHSA-qp32-wqxw-wq3h.
2026-08-23	Fixed for the upcoming WeKan release.