- Server methods bypassed the private-only board visibility policy (CWE-863).
- Board creation and card-to-board conversion now force private visibility when required, recording blocked overrides in Admin Panel Problems.
- More details
| CVE | Icon | Vulnerability name | Date | Responsible Security Disclosure by | Stars | Process | Vulnerabilities |
|---|---|---|---|---|---|---|---|
| - | VisibilityBleed | 2026-09-14 | Wenhao Wu, Southeast University | |
Responsible disclosure through a saved GitHub security advisory; sibling path found during remediation. |
|
The server-side createBoardWithInitialSwimlanes method accepted public visibility even when the instance allowed only private boards. A sibling card-to-board conversion inherited public visibility. Collection allow/deny does not protect these server inserts.
Both methods apply the instance policy before insertion. Blocked public overrides use the bounded security event summary in Admin Panel Problems; logging failures do not break enforcement.
Targeted policy and insert-inventory suites pass. Browser regression added and syntax-checked; live execution remains pending. No CVE has been assigned here.