- Server methods bypassed the private-only board visibility policy (CWE-863).
- Board creation and card-to-board conversion now force private visibility when required, recording blocked overrides in Admin Panel Problems.
- More details
| CVE | Icon | Vulnerability name | Date | Responsible Security Disclosure by | Stars | Process | Vulnerabilities |
|---|---|---|---|---|---|---|---|
| - | VisibilityBleed | 2026-09-14 | Wenhao Wu, Southeast University | |
Responsible disclosure through a saved GitHub security advisory; sibling path found during remediation. |
|
The server-side createBoardWithInitialSwimlanes method accepted public visibility even when the instance allowed only private boards. A sibling card-to-board conversion inherited public visibility. Collection allow/deny does not protect these server inserts.
Both methods apply the instance policy before insertion. Blocked public overrides use the bounded security event summary in Admin Panel Problems; logging failures do not break enforcement.
Targeted policy and insert-inventory suites pass. Browser regression added and syntax-checked; live execution remains pending. No CVE has been assigned here.
Trello and WeKan imports wrote boards through Boards.direct, which skips the hook that enforces Admin Panel's "private boards only" policy, so an export marked public or instance arrived open. Both importers now apply the policy before writing. Fix.