Contents / TenantBleed

CVE	Vulnerability name	Date	Responsible Security Disclosure by	Vulnerabilities
GHSA-p4cq-83j9-7g73	TenantBleed	2026-08-21	Char0n1507 and xet7 Coordinated disclosure with all six operations reproduced.	Authenticated users could insert, update and remove self-ID Organization and Team configuration through DDP (CWE-563, CWE-862) Affected WeKan v11.06.0 and earlier Severity: Moderate; unauthorized tenant/team configuration modification and deletion Fixed at upcoming WeKan release

Details

TenantBleed — a matching document id was treated as administrative authority (CWE-563, CWE-862)

The Meteor collection allow rules for Organization and Team correctly permitted site administrators, but also permitted any authenticated user whenever doc._id === userId. An ordinary user could therefore create a self-ID configuration document and then modify or delete it without organization/team administration, membership, tenant scope or a field-level restriction.

All six operations — /org/insert, /org/update, /org/remove, /team/insert, /team/update and /team/remove — were reproduced against WeKan v11.06. Exposed fields included domain, member-propagation, branding and authentication-synchronization configuration.

Fix: both collections now use one site-admin-only permission helper. The self-ID exception is gone. Legitimate scoped and internal writes continue through server methods that enforce their own site-admin, tenant-admin, OIDC or LDAP contracts. Denied authenticated attempts are rate-limited, attributed and visible in Admin Panel → Problems under TenantBleed.

Regression tests cover insert, update and remove on both collections, reject document-ID authorization, and pin the shared site-admin decision.

Timeline	Details
2026-08-21	Report received from Char0n1507 through GitHub Security Advisory GHSA-p4cq-83j9-7g73.
2026-08-21	Fixed for the upcoming WeKan release.