v9.37 2026-06-11 WeKan ® release

This release fixes the following CRITICAL SECURITY ISSUES of BoardBleed:

• Fixed BoardBleed: Broken access control lets any authenticated user move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)](https://github.com/wekan/wekan/security/advisories/GHSA-gm7v-pc38-53jr) (CWE-284, CWE-639). WeKan boards are membership-scoped, but the DDP collection write policies for Cards, Lists and Swimlanes (server/permissions/cards.js, server/permissions/lists.js, server/permissions/swimlanes.js) authorized an update by checking only the CURRENT (pre-update) boardId of the document — i.e. the attacker’s own source board — and never validated the NEW boardId supplied in the update modifier. Because every logged-in user can create a board where they are admin, an attacker could take a document they own and, in a single /cards/update, /lists/update or /swimlanes/update DDP call, $set its boardId (plus swimlaneId/listId) to a victim’s private board: the allow rule saw the attacker’s own source board, approved the write, and the document was relocated into a board the attacker is not a member of and cannot even read. This let an unprivileged user inject arbitrary cards/lists/swimlanes (attacker-controlled titles, descriptions, assignees, etc.) into any private board by id, defeating board-level access control. The REST API for the same operation (PUT /api/boards/:boardId/lists/:listId/cards/:cardId with newBoardId) was not affected because it correctly calls Authentication.checkBoardWriteAccess(req.userId, newBoardId) on the destination board; only the DDP allow/deny layer was vulnerable. Fixed by adding a denyCrossBoardMove helper in server/lib/utils.js and a Cards.deny/Lists.deny/ Swimlanes.deny update rule on each collection that rejects any update whose modifier $sets a boardId on which the caller does not have write access, so a cross-board move is only allowed into a destination board where the user is an active write-capable member. Affected Wekan v9.35 and earlier. Thanks to 0xzap, xet7 and Claude.

and adds the following updates:

• Update release website script version numbering. Thanks to xet7 and Claude.

Thanks to above GitHub users for their contributions and translators for their translations.