MigrationBleed

CVE	Icon	Vulnerability name	Date	Responsible Security Disclosure by	Stars	Process	Vulnerabilities
-		MigrationBleed	2026-10-02	xet7		Found while auditing attachment migration methods after the 2026-10-02 Hall of Fame review; fixed by xet7.	The attachmentMigration.getProgress and getUnconvertedAttachments methods returned whole stored attachment documents - storage paths, versions, uploader, and the names of files on cards the caller cannot see - to anyone who could read the board. They now return attachment ids only. CWE-200. Medium severity: board readers, including assigned-only members. No CVE assigned. Fix prepared locally for the Upcoming release; not yet released.

Details

The attachment migration shows its progress to anyone who can read the board, and the methods behind it answered with the stored attachment documents themselves. Those carry the file's storage path on the server, its versions, who uploaded it, its name and the card it is on.

A member who may see only some cards - an assigned-only member - learned the names and uploaders of files on every card, and every reader learned the server's storage layout.

Fix

Both methods return attachment ids only, which is all the progress display needs.

Detection

None. The fix changes what a response carries; reading migration progress is ordinary use, so there is no attempt to record in Admin Panel → Problems.

Verification

Unit tests in tests/attachmentMigrationLeak.test.cjs check that both reader-facing answers carry attachment ids only, and the negative test checks that the client needs nothing but the id. The unit tests pass in the WeKan repository. There is no browser test.

Source fix and regression tests