| Название | Wekan <8.21 Missing authorization checks leading to information disclosure a |
|---|
| Описание | Position-history tracking server methods did not consistently require authentication and board visibility checks. The fix enforces that the caller is logged in and verifies the user has access to the relevant board before proceeding with swimlane/list/card position-history operations. |
|---|
| Источник | ⚠️ https://github.com/wekan/wekan/commit/55576ec17722db094835470b386162c9a662fb60 |
|---|
| Пользователь | MegaManSec (UID 94702) |
|---|
| Представление | 20.01.2026 12:52 (9 месяцы назад) |
|---|
| Модерация | 04.02.2026 15:46 (15 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 344269 [WeKan до 8.20 Position-History Tracking positionHistory.js PositionHistoryBleed эскалация привилегий] |
|---|
| Баллы | 17 |
|---|