GHSA-9w4x-hf2r-hc9v was reported by crypto-nidh.
Move, link and bulk-move automation actions execute on the server, outside the collection allow/deny callbacks. A user who could create a rule on their own board could therefore name an inaccessible private board as its destination and inject cards there. Destination list and swimlane matching also exposed a blind oracle for private board structure.
Fix: rule creation now requires write access to a different destination before storing any rule document. Execution checks again before looking up destination structure, protecting scheduled, legacy, imported and directly stored rules. Rejected attempts are bounded and summarized as RuleBleed in Admin Panel → Problems. Fixed for the upcoming WeKan v11.21 release on 2026-08-29.