GHSA-5fc2-m4gw-j6qq was reported by Char0n1507.
An authenticated user could store a history record naming another private board and then undo it, moving a controlled card into that board.
Fix: history insertion requires membership on every named board, and undo rechecks both the history board and destination membership immediately before the move. Denied cross-board attempts are bounded and summarized as PositionHistoryBleed in Admin Panel → Problems with the account and source address. Fixed in the upcoming WeKan release on 2026-08-25.
Clients could still insert position-history entries naming another board's card or list. Client inserts are now denied, and undo and redo apply an entry only when what it moves is still on its boards and the user can write there. Fix.