wekan
diff --git a/‎hall-of-fame/index.html‎
Lines changed: 22 additions & 0 deletions b/‎hall-of-fame/index.html‎
Lines changed: 22 additions & 0 deletions
diff --git a/‎hall-of-fame/rulebleed/index.html‎
Lines changed: 9 additions & 0 deletions b/‎hall-of-fame/rulebleed/index.html‎
Lines changed: 9 additions & 0 deletions
@@ -86,6 +86,28 @@ <h3 class="hof">
         <th width="19%">Vulnerabilities</th>
       </tr>
 
+      <tr>
+        <td valign="top"><a href="https://github.com/wekan/wekan/security/advisories/GHSA-9w4x-hf2r-hc9v">GHSA-9w4x-hf2r-hc9v</a></td>
+        <td class="icon" valign="top"><h2><i class="fa fa-cogs" aria-hidden="true"></i> <i class="fa fa-tint" style="color: red;" aria-hidden="true"></i></h2></td>
+        <td valign="top"><b>RuleBleed</b></td><td valign="top">2026-08-29</td>
+        <td class="by" valign="top"><b><a href="https://github.com/crypto-nidh">crypto-nidh</a></b> and <b><a href="https://github.com/xet7">xet7</a></b></td>
+        <td class="stars" valign="top"><img src="GoldStar.png" width="30px" height="auto" /><img src="GoldStar.png" width="30px" height="auto" /></td>
+        <td valign="top">
+          <details>
+          <summary>Process</summary>
+
+          Coordinated disclosure through a GitHub security advisory, verified against DDP-created, scheduled and legacy automation paths.
+          </details>
+        </td>
+        <td valign="top">
+          <details>
+          <summary>Details</summary>
+
+          <ul><li>Server-side automation bypassed the collection cross-board deny hook (CWE-862, CWE-863)</li><li>Rule registration and execution now independently enforce destination write access</li><li>Authorization runs before destination list or swimlane lookup, removing the private-structure oracle</li><li>Denied attempts are summarized in Admin Panel &rarr; Problems</li><li><a href="rulebleed/">More details</a></li></ul>
+          </details>
+        </td>
+      </tr>
+
       <tr>
         <td valign="top"><a href="https://github.com/wekan/wekan/security/advisories/GHSA-4mjm-vj9f-p629">GHSA-4mjm-vj9f-p629</a></td>
         <td class="icon" valign="top"><h2><i class="fa fa-user-circle" aria-hidden="true"></i> <i class="fa fa-tint" style="color: red;" aria-hidden="true"></i></h2></td>
 
@@ -0,0 +1,9 @@
+<html><head><meta charset="UTF-8"><title>WeKan — Hall of Fame / RuleBleed</title><link rel="stylesheet" type="text/css" href="../../css/main.css"></head>
+<body><img src="../hof.svg" alt="Hall of Fame trophy" width="300px" height="auto" />
+<div class="action-buttons"><a class="button" href="https://wekan.fi/hall-of-fame">Back to Hall of Fame Contents</a></div>
+<div class="hof"><h1 class="hof">Contents / RuleBleed</h1>
+<h2>Automation-rule cross-board authorization bypass</h2>
+<p><a href="https://github.com/wekan/wekan/security/advisories/GHSA-9w4x-hf2r-hc9v">GHSA-9w4x-hf2r-hc9v</a> was reported by <a href="https://github.com/crypto-nidh">crypto-nidh</a>.</p>
+<p>Move, link and bulk-move automation actions execute on the server, outside the collection allow/deny callbacks. A user who could create a rule on their own board could therefore name an inaccessible private board as its destination and inject cards there. Destination list and swimlane matching also exposed a blind oracle for private board structure.</p>
+<p><b>Fix:</b> rule creation now requires write access to a different destination before storing any rule document. Execution checks again before looking up destination structure, protecting scheduled, legacy, imported and directly stored rules. Rejected attempts are bounded and summarized as RuleBleed in Admin Panel &rarr; Problems. Fixed for the upcoming WeKan v11.21 release on 2026-08-29.</p>
+</div></body></html>