GHSA-2x89-6mq2-834r was reported by crypto-nidh.
The default-swimlane Meteor method checked only board membership before inserting a structural object, so read-only roles could bypass the collection write rules.
Fix: the method now requires the shared board write capability before insertion. Rejected attempts are bounded and summarized as SwimlaneBleed in Admin Panel → Problems. Fixed for the upcoming WeKan v11.21 release on 2026-08-28.