Contents / OwnerBleed

CVE	Vulnerability name	Date	Responsible Security Disclosure by	Vulnerabilities
GHSA-6jvj-85q3-6q2m	OwnerBleed	2026-08-22	Char0n1507 and xet7 Coordinated disclosure with a working reproduction and root-cause analysis.	Authenticated users could create a board attributed to another user by supplying owner fields in the REST body (CWE-639) Affected WeKan v11.07 and earlier Severity: Moderate; ownership and audit-integrity impact Fixed at upcoming WeKan release

Details

OwnerBleed — board creation trusted client-selected ownership (CWE-639)

The REST board-creation route copied owner and role fields from the request body instead of deriving ownership from the authenticated principal.

Fix: the authenticated caller is always the initial active administrator and owner. Client-supplied ownership and role flags are ignored.

Timeline	Details
2026-08-22	Report received from Char0n1507 through GitHub Security Advisory GHSA-6jvj-85q3-6q2m.
2026-08-22	Fixed for the upcoming WeKan release.