GHSA-5fc2-m4gw-j6qq was reported by Char0n1507.
An authenticated user could store a history record naming another private board and then undo it, moving a controlled card into that board.
Fix: history insertion requires membership on every named board, and undo rechecks both the history board and destination membership immediately before the move. Denied cross-board attempts are bounded and summarized as PositionHistoryBleed in Admin Panel → Problems with the account and source address. Fixed in the upcoming WeKan release on 2026-08-25.