| 标题 | Wekan <8.21 Authorization bypass (CWE-284) |
|---|
| 描述 | WIP limit related operations did not consistently enforce that only authorized users (typically and normally board admins) could change list WIP settings, allowing authentication bypasses for Wekan WIP. The fix adds explicit authorization checks to ensure only permitted users can modify WIP limits.
|
|---|
| 来源 | ⚠️ https://github.com/wekan/wekan/commit/8c0b4f79d8582932528ec2fdf2a4487c86770fb9 |
|---|
| 用户 | MegaManSec (UID 94702) |
|---|
| 提交 | 2026-01-20 12時58分 (9 月前) |
|---|
| 管理 | 2026-02-05 11時52分 (16 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 344267 [WeKan 直到 8.20 Attachment Storage models/lists.js applyWipLimit ListWIPBleed 权限提升] |
|---|
| 积分 | 0 |
|---|