| Название | Wekan <8.21 Improper access control on administrative migration methods (CWE |
|---|
| Описание | Migration-related operations (including URL fixups) lacked sufficient authorization checks and accepted parameters that expanded scope. The fix removes the boardId parameter from some migration steps (making them global), and adds explicit authorization requiring board admin or instance admin for board-scoped migration execution, and admin checks for migration invocation. |
|---|
| Источник | ⚠️ https://github.com/wekan/wekan/commit/cc35dafef57ef6e44a514a523f9a8d891e74ad8f |
|---|
| Пользователь | MegaManSec (UID 94702) |
|---|
| Представление | 20.01.2026 12:52 (9 месяцы назад) |
|---|
| Модерация | 04.02.2026 15:46 (15 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 344268 [WeKan до 8.20 Migration Operation comprehensiveBoardMigration.js ComprehensiveBoardMigration boardId MigrationBleed эскалация привилегий] |
|---|
| Баллы | 19 |
|---|