TrayBleed

CVE Icon Vulnerability name Date Responsible Security Disclosure by Stars Process Vulnerabilities

CVE	Icon	Vulnerability name	Date	Responsible Security Disclosure by	Stars	Process	Vulnerabilities
-		TrayBleed	2026-10-02	xet7		Found while auditing client-writable profile fields after the 2026-10-02 Hall of Fame review; fixed by xet7.	A user's `profile.notifications` fell under the rule that lets a client write its own `profile.*`. A tray entry names an activity, and the notification publications send that activity with its card, comments, checklists and attachments from any board. So a client could push any activity id into its own tray and read what it pointed at. A client may now only set an entry's read state and remove entries; the server alone adds them. CWE-639. High severity: any signed-in user, with an activity id. No CVE assigned. Fix prepared locally for the Upcoming release; not yet released.

TrayBleed

2026-10-02

xet7

Found while auditing client-writable profile fields after the 2026-10-02 Hall of Fame review; fixed by xet7.

A user's profile.notifications fell under the rule that lets a client write its own profile.*. A tray entry names an activity, and the notification publications send that activity with its card, comments, checklists and attachments from any board. So a client could push any activity id into its own tray and read what it pointed at.

A client may now only set an entry's read state and remove entries; the server alone adds them.

CWE-639. High severity: any signed-in user, with an activity id. No CVE assigned. Fix prepared locally for the Upcoming release; not yet released.

Details

The notification tray is stored on the user as profile.notifications, a list of entries that each name an activity and say whether it was read. The client may write its own profile.* fields - language, view settings and the like - and the tray fell under the same rule.

The notification publications send each entry's activity together with the card it is about and that card's comments, checklists and attachments, trusting that the server put the entry there because the user could see it. A client that added an entry naming an activity of another board received that board's card content.

Fix

A client update to profile.notifications may only change an existing entry's read state or pull entries. Adding or rewriting an entry is refused; the server adds them when it notifies.

Detection

An added or rewritten tray entry is refused and summarized as TrayBleed in Admin Panel → Problems (catalog key authz.notification-tray).

Verification

Unit tests in tests/notificationTrayWrite.test.cjs show that adding or rewriting a tray entry is refused, that what the client really does - marking read and removing - stays allowed, and that the deny rule records the attempt. The unit tests pass in the WeKan repository. There is no browser test.

Source fix and regression tests

Problems key and naming