Contents / TokenAuditBleed

CVE	Vulnerability name	Date	Responsible Security Disclosure by	Vulnerabilities
GHSA-5r57-9vj7-c64f	TokenAuditBleed	2026-08-22	Char0n1507 and xet7 Coordinated disclosure with a working reproduction and root-cause analysis.	An administrator API could create another user login token without an impersonation audit record (CWE-778) Affected WeKan v11.07 and earlier Severity: High; privileged-accountability and token-misuse impact Fixed at upcoming WeKan release

Details

TokenAuditBleed — administrator token issuance bypassed impersonation auditing (CWE-778)

The REST token endpoint generated a reusable login token for any target user after an administrator check, but omitted the audit record created by the normal impersonation workflow.

Fix: the endpoint requires a reason, verifies the target, and records administrator, target and reason before inserting the token. An unaudited request is rejected.

Timeline	Details
2026-08-22	Report received from Char0n1507 through GitHub Security Advisory GHSA-5r57-9vj7-c64f.
2026-08-22	Fixed for the upcoming WeKan release.