GHSA-hvvr-j425-5xxm was reported by Char0n1507.
Subtask export queries matched only a parent card identifier. A private-board card naming a card on another board could therefore appear in that board's JSON, ZIP, Excel or PDF export.
Fix: all six board and card export query paths now require the subtask to belong to the exported board. This changes what a legitimate export can contain rather than denying an attributable request, so ordinary exports are not logged as attacks. Fixed in the upcoming WeKan release on 2026-08-25.