Wekan
Open source kanban board application built with Meteor
Alternative to: trello
v11.27
2026-08-29Binaries in these bundles
Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools. Which source has a given CPU varies from release to release - nodejs.org builds some architectures, unofficial-builds others, and the wekan/node-patches build the ones neither of them does - and not every source publishes a checksum. This is what went into this release, and which downloads were checked against a published SHA256.
| Bundle | Binary | From | Version | Checked | SHA256 |
|---|---|---|---|---|---|
| amd64 | FerretDB | wekan/FerretDB | v1.63.0 | verified | c9570b1b849d5066… |
| amd64 | Node.js | nodejs.org | v24.20.0 | verified | 2f2c0da162318f0d… |
| arm64 | FerretDB | wekan/FerretDB | v1.63.0 | verified | 019d60c6d2bcee74… |
| arm64 | Node.js | nodejs.org | v24.20.0 | verified | 5f4ddab610c1ab20… |
A row saying no checksum published is not a failed check - it is a source that publishes nothing to check against. Those are the ones worth fixing at the source.
v11.27 2026-08-29 WeKan ® release
In short: SearchBleed closes a global-search authorization bypass that let an authenticated user submit an executable database selector and search cards outside their boards on MongoDB deployments. Initial searches and stored pagination selectors are now independently rejected or constrained to the caller’s current board access.
| Platform | Binary | From | Version | SHA256 |
|---|---|---|---|---|
| amd64 | Node.js | nodejs.org | v24.19.0 | 14b342e71204f811bde6153be8e04b62aef63c236fef92b55f9c83154b409647 |
| amd64 | FerretDB | wekan/FerretDB | v1.53.0 | eae1f0a8f73bfc979738bfff7284d40fd1bc55de2cc56514721fc155c3624f7d |
| arm64 | Node.js | nodejs.org | v24.19.0 | 01443c1e1a29e531ccad5a46fefa6df490d2189c49f7955904aecdbb0fe86fdc |
| arm64 | FerretDB | wekan/FerretDB | v1.53.0 | bdc50caee3ac28495b42d2130b94a042a9dd6d3a38f732cac02b648f36c891da |
| mac-arm64 | Node.js | nodejs.org | v24.19.0 | 3f1cf157479c1480352083105e13faf9d008ede98e7e157746b6df940d197b94 |
| mac-arm64 | FerretDB | wekan/FerretDB | v1.53.0 | cb14ffe93e285903e5a8a9c1821687ddb5b8a979a11c584bf4af534b272c6d3e |
| mac-x64 | Node.js | nodejs.org | v24.19.0 | d35e95230f46f6f0751df497c56622c6735e05d5e1fb1630996a005b9d328fe4 |
| mac-x64 | FerretDB | wekan/FerretDB | v1.53.0 | d97dfa9afa60aa05f25384327de82efe7b71d958ed24c1f66618284294a65cd3 |
This release fixes the following CRITICAL SECURITY ISSUE of SearchBleed:
Global search cannot execute untrusted selectors or cross board boundaries. Thanks to crypto-nidh and xet7.
GHSA-33h9-rc5h-667p, High, CWE-943. The global-search publication accepted a selector supplied by an authenticated client and used it instead of the normal board-scoped selector. On MongoDB, execution operators could cause denial of service and act as an oracle over cards belonging to inaccessible boards. FerretDB rejected the reported execution operator, but the missing authorization boundary existed in the application and is now enforced independently of the database backend.
Executable selectors now go through WeKan’s shared NoSQL guard before reaching the database. Other client selectors are conjoined with the caller’s authorized board IDs rather than replacing that scope. The shared query path repeats both checks for stored next-page and previous-page selectors, so sessions created by an older vulnerable release cannot preserve broader access after upgrade. Positive, negative and legacy-session unit coverage pins both layers; the existing rendered-browser search regression verifies that inaccessible-board cards remain absent while ordinary global search continues to work.
Thanks to above GitHub users for their contributions and translators for their translations.