v9.89 2026-07-13 WeKan ® release

This release fixes the following CRITICAL SECURITY ISSUE of SortBleed:

• SortBleed: a low-privilege (comment-only / read-only) board member could escalate to board admin and take over a private board via the board sort collection-allow rule (GHSA-xm8x-c8wg-jhmf, CWE-863 Incorrect Authorization, CWE-269 Improper Privilege Management). Same broken-access-control class as BoardBleed (CVE-2026-55234) — a Meteor collection allow-rule field conflation — but on the Board document itself. To support drag-to-reorder on the All Boards / Public Boards pages, a second Boards.allow({ update }) rule returned true for any board member whenever the update touched the sort field. Meteor evaluates allow rules with OR semantics and does not scope an approving rule to the field that satisfied it: once any allow callback returns true and no deny callback returns true, the entire modifier is applied. Because canUpdateBoardSort only checked that sort was among the modified fields (not that it was the only one), a comment-only / read-only member could smuggle arbitrary board mutations into the same $set as sort in a single unprivileged DDP Boards.update call: {$set: {sort: 99, members: [...only themselves as admin...], permission: 'public', title: '...'}}. The member could therefore make themselves board admin, flip a private board to public (world-readable in Wekan), rename it, and evict the legitimate owner. The last-admin deny rule did not help because it only inspected $pull, so a wholesale $set of the members array bypassed it entirely.
  • Fixed by restricting canUpdateBoardSort (server/lib/utils.js) so the sort-reorder rule approves an update only when sort is the sole modified field (fieldNames is exactly ['sort']) — it can no longer approve a modifier that also mutates members, permission, title or anything else. As defense in depth, the last-admin deny rule (server/permissions/boards.js) now also rejects a $set rewrite of the members array that would drop the last active admin, not just a $pull. A regression test covers the multi-field smuggling case (server/lib/tests/boards.security.tests.js). The legitimate All Boards drag-reorder is unaffected: it persists the order per-user in profile.boardSortIndex (Users.setBoardSortIndex), not in the board document. CVSS:3.1 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
  • Affected Wekan v9.85 and earlier through the current release; fixed at the upcoming WeKan release. Reported by 5ud0 / Tarmo Technologies. Thanks to 5ud0 / Tarmo Technologies and xet7.

and adds the following updates:

• Update Sandstorm WeKan info. Part 1, Part 2, Part 3. Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their translations.