| 标题 | Wekan <8.21 Missing authorization checks leading to information disclosure a |
|---|
| 描述 | Position-history tracking server methods did not consistently require authentication and board visibility checks. The fix enforces that the caller is logged in and verifies the user has access to the relevant board before proceeding with swimlane/list/card position-history operations. |
|---|
| 来源 | ⚠️ https://github.com/wekan/wekan/commit/55576ec17722db094835470b386162c9a662fb60 |
|---|
| 用户 | MegaManSec (UID 94702) |
|---|
| 提交 | 2026-01-20 12時52分 (9 月前) |
|---|
| 管理 | 2026-02-04 15時46分 (15 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 344269 [WeKan 直到 8.20 Position-History Tracking positionHistory.js PositionHistoryBleed 权限提升] |
|---|
| 积分 | 17 |
|---|