Contents / RoleBleed

CVE	Vulnerability name	Date	Responsible Security Disclosure by	Vulnerabilities
GHSA-cp24-5m9m-wm97	RoleBleed	2026-08-22	senti-man and xet7 Coordinated disclosure with a working reproduction and root-cause analysis.	REST checklist, item and comment routes enforced inconsistent board-role capabilities (CWE-863 Incorrect Authorization) Affected WeKan v11.07 and earlier Severity: Moderate; intra-board integrity and availability impact Fixed at upcoming WeKan release

Details

RoleBleed — REST capabilities drifted from the canonical role table (CWE-863)

Several checklist mutations required only read access, while comment creation required full write access and rejected legitimate Comment Only members.

Fix: content mutations now require board write access and comment creation uses the canonical comment capability. Regression tests cover allowed and denied roles.

Timeline	Details
2026-08-22	Report received from senti-man through GitHub Security Advisory GHSA-cp24-5m9m-wm97.
2026-08-22	Fixed for the upcoming WeKan release.