Hall of Fame trophy
Back to Hall of Fame Contents

Contents / SubtaskExportBleed

Private card disclosure through cross-board subtask exports

GHSA-hvvr-j425-5xxm was reported by Char0n1507.

Subtask export queries matched only a parent card identifier. A private-board card naming a card on another board could therefore appear in that board's JSON, ZIP, Excel or PDF export.

Fix: all six board and card export query paths now require the subtask to belong to the exported board. This changes what a legitimate export can contain rather than denying an attributable request, so ordinary exports are not logged as attacks. Fixed in the upcoming WeKan release on 2026-08-25.