| タイトル | Wekan <8.21 IDOR via REST API / improper object relationship validation |
|---|
| 説明 | Certain REST endpoints for checklist items accepted boardId/cardId/checklistId parameters but did not sufficiently verify that the referenced checklist item belonged to the specified card and board. This could allow an authenticated user with access to one board to act on checklist items from another board by guessing or obtaining object IDs. The fix adds relationship checks (item.cardId, item.checklistId, card.boardId) and returns 404 when mismatched. |
|---|
| ソース | ⚠️ https://github.com/wekan/wekan/commit/cabfeed9a68e21c469bf206d8655941444b9912c |
|---|
| ユーザー | MegaManSec (UID 94702) |
|---|
| 送信 | 2026年01月20日 12:36 (7 月 ago) |
|---|
| モデレーション | 2026年02月04日 15:36 (15 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 344265 [WeKan 迄 8.20 REST API models/boards.js setBoardOrgs item.cardId/item.checklistId/card.boardId 特権昇格] |
|---|
| ポイント | 20 |
|---|