← Back to Security Research Portal (ccsimplyspolit.github.io)

GHSA-8885-xrq4-j47h: Cross-Board Checklist Disclosure in Scoped Board Export and Policy Bypass in Streaming CSV/TSV Export (wekan/wekan)

[OFFICIALLY PUBLISHED BY VENDOR]
Officially published by upstream maintainer on 2026-11-02T07:17:25Z as GHSA-8885-xrq4-j47h (state: published, CVSS v3.1 5.3 MEDIUM) with accepted reporter credit to @ccsimplyspolit.

0x00 // GitHub Security Advisory & Remediation Metadata

{
  "ghsa_id": "GHSA-8885-xrq4-j47h",
  "repository": "wekan/wekan",
  "package": "other:wekan",
  "vulnerable_version_range": "<= 12.77",
  "patched_versions": "12.78",
  "html_url": "https://github.com/wekan/wekan/security/advisories/GHSA-8885-xrq4-j47h",
  "state": "published",
  "published_at": "2026-11-02T07:17:25Z",
  "summary": "Cross-Board Checklist Disclosure in Scoped Board Export and Policy Bypass in Streaming CSV/TSV Export",
  "severity": "medium",
  "cvss_v3": {
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
    "score": 5.3,
    "severity": "MEDIUM"
  },
  "cvss_v4": {
    "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
    "score": 6.9,
    "severity": "MEDIUM"
  },
  "status": "Officially Published by Vendor (GHSA-8885-xrq4-j47h) \u2022 Patched in v12.78",
  "credits": [
    {
      "login": "ccsimplyspolit",
      "type": "reporter",
      "state": "accepted"
    }
  ],
  "cwe_ids": [
    "CWE-359",
    "CWE-639",
    "CWE-863"
  ]
}