old-CHANGELOG/2026/05.md
Moved out of CHANGELOG.md to keep that file small enough to open (wekan/wekan#6580). Nothing here has been changed: a release section is a record, and it reads the same as it did there.
Releases per day:
| 2026-05 | Releases |
|---|---|
| 01 | 1 |
| 02 | 3 |
| 04 | 1 |
| 07 | 5 |
| 08 | 1 |
| 09 | 1 |
| 10 | 2 |
| 16 | 2 |
| 17 | 1 |
| 18 | 1 |
| 21 | 1 |
| 22 | 7 |
| 27 | 1 |
| 31 | 3 |
This release fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release adds the following fixes, In Progress:
Mobile / touch fixes (Fairphone 4 postmarketOS Firefox and Fairphone 4 Ubuntu Touch Morph browser; iPhone 12 Mini was already correct):
<details> <summary>Fixed one-finger drag-to-scroll not working in the All Boards view and the Calendar view on…</summary>Fixed one-finger drag-to-scroll not working in the All Boards view and the
Calendar view on Fairphone 4 Firefox and Ubuntu Touch Morph. These browsers do
not emit the synthetic mouse events the @wekanteam/dragscroll library relies
on, so scrolling only worked in the Swimlanes/Lists views. Added a new native
touch-scrolling helper client/lib/dragscrollTouch.js that scrolls the nearest
.dragscroll container with a one-finger drag (iOS is skipped, since native
momentum scrolling already works there), and added the dragscroll class to the
All Boards list and the Calendar view.
Fixed all text, buttons, the All Boards tables and the top bars (header and the
second bar) rendering about 2x too large on Fairphone 4. getMobileMode()
defaulted to mobile mode only for iPhone, so every other phone fell back to
desktop mode, whose large desktop sizing looks oversized on a small phone
screen. The default is now mobile mode for any phone-sized touch device (iPhone,
Android/Mobile browsers, Ubuntu Touch, or a coarse-pointer touch screen with
viewport width ≤ 800px); desktop browsers stay in desktop mode and the user's
own Mobile/Desktop toggle still takes priority.
Fixed not being able to reorder swimlanes and lists by dragging their drag
handle on touch devices. The new touch-scroll helper was hijacking touches that
started on a drag handle; .handle / .ui-sortable-handle elements are now
excluded from touch-scrolling so dragging the handle reorders as expected.
Fixed a card duplicating into two cards when it was dragged by its title-row
drag handle while its Card Details panel was open. The card sortable in
client/components/lists/list.js was re-initialized on every list re-render
without first destroying the previous instance, so two stop handlers fired per
drag. It now destroys any existing sortable before re-initializing, the same
guard already used for swimlanes.
Attachment storage:
<details> <summary>Added configurable attachment storage backends in the admin panel: choose the default save storage…</summary>Added configurable attachment storage backends in the admin panel: choose the
default save storage and store attachments on the local filesystem, GridFS, or
cloud object storage — S3-compatible (AWS S3, MinIO, Cloudflare R2, Backblaze
B2, Wasabi, DigitalOcean Spaces), Azure Blob Storage, or Google Cloud Storage —
via the @tweedegolf/storage-abstraction adapters (new
models/lib/cloudStorage.js). Includes a "Test connection" action and English
translations for the new settings.
Added a server-side bulk attachment move (new server/attachmentBulkMove.js and
models/attachmentBulkMoveStatus.js) that moves all attachments from one
storage backend to another as a background job whose progress survives the admin
navigating away from or closing the page.
Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
This release fixes the following CRITICAL SECURITY ISSUES:
<details> <summary><a href="https://github.com/wekan/wekan/commit/0e5fef6f31164fd3de4db353d04173ee0490cd65">Fix GHSA-hc3x-hq3m-663q: Server-Side Request Forgery (SSRF) via webhook integration URLs (CWE-918)</a>.</summary>Fix GHSA-hc3x-hq3m-663q: Server-Side Request Forgery (SSRF) via webhook
integration URLs (CWE-918) Wekan's outgoing-webhook integrations let a board
admin store an arbitrary URL that is later fetched server-side, so a
caller-controlled URL pointing at an internal address (cloud metadata at
http://169.254.169.254/latest/meta-data/, loopback, RFC 1918 ranges, etc.)
could be used to reach internal services or exfiltrate data
server/notifications/outgoing.js through
fetchSafe (server/lib/ssrfGuard.js), which validates the URL and blocks
private/loopback IPs, and Fix RebindBleed of IntegrationBleed
(v8.36)
hardened it further to resolve DNS once, pin the connection to the validated
IP, and block redirects — closing the actual request-time SSRF including DNS
rebinding.server/models/integrations.js.
Those endpoints accepted webhook URLs without a robust check: POST /api/boards/:boardId/integrations relied only on the schema's regex
custom() validator (no DNS resolution, blind to a hostname that resolves
to a private IP and to decimal/octal/IPv4-mapped-IPv6 encodings), and PUT /api/boards/:boardId/integrations/:intId wrote the URL via
Integrations.direct.updateAsync, which bypasses schema validation
entirely, so updated URLs were never validated at the data layer. Both
endpoints now run the DNS-aware validateAttachmentUrl()
(models/lib/attachmentUrlValidation.js, the same validator already used
for attachment imports) before storing the URL, rejecting
private/loopback/link-local/reserved targets with HTTP 400. Together with
the v8.35/v8.36 fetchSafe delivery guard and the schema validator on
client-side inserts/updates, webhook URLs are now validated on every write
path and again at delivery.
Thanks to xet7.Fix GHSA-7w2h-g83c-jqrp: Authorization bypass in copyBoard DDP method allows
any user to copy private boards (CWE-862) The copyBoard Meteor method in
server/publications/boards.js had no authorization check: any logged-in user
could copy any board by ID — including private boards they are not a member of —
cloning all cards, checklists, custom fields, labels and rules, while the
equivalent REST endpoint POST /api/boards/:boardId/copy correctly required
board admin. The method also looped over caller-supplied properties (for (const key in properties) board[key] = properties[key]) and copied them onto
the new board, letting an attacker inject arbitrary fields such as members (to
add themselves as admin of the copy) or permission: 'public' (to expose the
copy to everyone). The member-level fix shipped in v9.09 as part of the
AuthBleed fixes (caller must be authenticated, board must exist, caller must be
a board member, and members/permission are stripped from properties before
the copy). This release tightens it further to full parity with the REST
endpoint: copyBoard now requires the caller to be a board admin
(board.hasAdmin(this.userId), the same {isActive:true, isAdmin:true}
condition the REST API enforces via checkAdminOrCondition) rather than merely
a member
Fix GHSA-cv95-8h7c-2ffq: Missing authorization on OIDC Meteor methods allows
privilege escalation to admin (CWE-269, CWE-862) Six Meteor methods used
internally by the OIDC login flow were registered as globally DDP-callable with
no authorization, while their non-OIDC counterparts require admin.
setCreateOrgFromOidc and setOrgAllFieldsFromOidc (server/models/org.js),
setCreateTeamFromOidc and setTeamAllFieldsFromOidc (server/models/team.js)
let any authenticated user create/rename/ deactivate/modify arbitrary
organizations and teams — including orgAutoAddUsersWithDomainName — bypassing
the admin-only restriction. Most critically, groupRoutineOnLogin
(packages/wekan-oidc/oidc_server.js) sets isAdmin from caller-supplied group
data, so with PROPAGATE_OIDC_DATA enabled any authenticated user could call it
over DDP with {groups:[{isAdmin:true,forceCreate:true}]} and promote
themselves to global admin; boardRoutineOnLogin could likewise add the caller
to the default board. These six methods are only ever invoked server-side (via
Meteor.callAsync) during the OIDC handshake, where a fix that checks
isAdmin/this.userId would break legitimate group/admin propagation (the user
is not yet logged in or admin at that point). Fixed by rejecting any direct
client/DDP invocation: a server-to-server Meteor.callAsync runs with
this.connection === null, whereas a client call has a non-null connection, so
each of the six methods now throws not-authorized when this.connection !== null. The legitimate OIDC login flow is unaffected
Fix GHSA-mp7g-hj5q-gxhq: OIDC Account Takeover via Unconditional Email-Based
Account Merge in Accounts.onCreateUser hook (CWE-287) The onCreateUser hook
in server/models/users.js unconditionally merged an incoming OIDC login into
any existing Wekan account whose email or username matched the
(attacker-controlled) OIDC claims — no ownership check, no email-verification
check, no notification. An attacker who could present a matching
email/username claim (trivial on self-hosted Keycloak/Authentik, where the
email/email_verified claims are attacker-settable) inherited the victim's
_id, boards, cards, attachments, API tokens and admin status, all during the
attacker's own first OIDC login with no victim interaction. Fixed to fail
closed, mirroring LDAP_MERGE_EXISTING_USERS: matching is now by email only
(never username); auto-linking is opt-in via the new
OAUTH2_MERGE_EXISTING_USERS setting (OFF by default, so the default deployment
never merges); even when enabled the OIDC provider must assert
email_verified=true; otherwise the OIDC login is rejected with
oidc-email-already-in-use instead of merging. The provider's email_verified
claim is now captured into the OIDC service data in
packages/wekan-oidc/oidc_server.js
Fix GHSA-6733-4wgq-8xvr: Read-only board members could create/modify/delete
Custom Fields (privilege escalation via read-level authz on write operations,
CWE-862). All six mutating REST handlers in server/models/customFields.js
(POST/PUT custom-fields, POST/PUT/DELETE dropdown-items, DELETE custom-fields)
called the read-level Authentication.checkBoardAccess instead of the
write-level checkBoardWriteAccess, letting a board member with the read-only
role (isReadOnly / isReadAssignedOnly) write Custom Field data via the REST
API when WITH_API=true. Replaced the check with checkBoardWriteAccess in all
six mutating handlers (the two GET handlers correctly stay on
checkBoardAccess), mirroring lists.js/swimlanes.js/cards.js
Fix regression from the avatar RCE fix GHSA-35j7-h385-2q9g: external antivirus
scanner broken (asyncExec undefined) The avatar RCE fix renamed asyncExec to
asyncExecFile in models/fileValidation.js, but the admin-configured external
scanner command line still called the now-undefined asyncExec, throwing
ReferenceError (swallowed by the catch) and making every upload silently fail
validation whenever an external scanner was configured. Restored a shell-based
asyncExec used only for that admin-configured command line; MIME detection
still uses the shell-free asyncExecFile
Fix CodeQL 69: Polynomial regex DoS in Jade parser, part 2 Remove the redundant
$ anchor from the interpolation regex in compiler.js and bundled jade.js.
The greedy [\s\S]* already matches to end of string, so dropping $ keeps the
same match while eliminating the backtracking that CodeQL alert
js/polynomial-redos flagged
Fix CodeQL 63: Incomplete string escaping or encoding in bundled jade.js In
uglify-js's make_string (bundled twice into jade's browser bundle), the chosen
quote was escaped in a trailing str.replace(/'/g, "\\'") that CodeQL alert
js/incomplete-sanitization flags for not escaping backslashes in that same
call. Backslashes were already escaped in the earlier single-pass replace, so
this was a local false positive, but the fix folds the quote escaping into that
same pass (escaping both quotes), making the escaping atomic and complete while
keeping the emitted string literals decode-equivalent
and adds the following updates:
<details> <summary><a href="https://github.com/wekan/wekan/commit/b0918686a2e3e39511964be14321f30b5520c644">Added test menu options</a>. Thanks to xet7.</summary>Added test menu options "Test Playwright Chromium", "Test Playwright Firefox"
and "Test Playwright Webkit" to build.sh for running the Playwright end-to-end
test suite per browser
and adds the following new features:
<details> <summary><a href="https://github.com/wekan/wekan/commit/c956ab5a4e2d675641f8c74df2dcde675474ab06">Add User board access roles to Admin Panel / People / Roles</a>. Thanks to xet7.</summary>Add User board access roles to Admin Panel / People / Roles A new global "Roles"
tab in Admin Panel / People lets a site admin choose which board roles are
allowed to invite users to a board ("Allow Invite to Board"). Each board role
has its own toggle — Board Admin, Normal, Worker, Comment only, No comments,
Only Assigned Normal, Only Assigned Comment, Read Only and Only Assigned Read —
plus an "All Board Members" master toggle that selects them all. The policy is
enforced server-side in the inviteUserToBoard and searchUsers methods, and
the add-member button in the board sidebar is shown only to roles the policy
allows. Global Admin Panel users (site admins) always have all rights and cannot
be restricted here; this is kept clearly distinct in code from the per-board
"Board Admin" role. Secure default: only Board Admin and Normal may invite
and fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release fixes the following CRITICAL SECURITY ISSUES:
<details> <summary><a href="https://github.com/wekan/wekan/commit/fc92b342ceedcf38dbd614a0f7b50d6dc2b22eb8">Fix GHSA-g6vm-7757-pr88. Moved Attachment Storage options from board to Admin Panel</a>. Thanks to Jan Kahmen of turingpoint GmbH for reporting GHSA-g6vm-7757-pr88 and xet7 for fixes and attachment improvements.</summary>Fix GHSA-g6vm-7757-pr88. Moved Attachment Storage options from board to Admin Panel. Changed API to use Expose Meteor user context to Express endpoints
</details>and adds the following updates:
and adds the following new features:
and fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release adds the following updates:
Thanks to above GitHub users for their contributions and translators for their translations.
This release adds the following updates:
Thanks to above GitHub users for their contributions and translators for their translations.
This release adds the following updates:
Thanks to above GitHub users for their contributions and translators for their translations.
This release tries to fix the following bugs:
<details> <summary><a href="https://github.com/wekan/wekan/commit/87a6354e4202fa779955026ee1eca8701398562a">Docker: Do not include pebble to final Docker container, only use it when building, because pebble…</a> Thanks to xet7.</summary>Docker: Do not include pebble to final Docker container, only use it when building, because pebble causes vulnerability warnings
</details>Thanks to above GitHub users for their contributions and translators for their translations.
This release adds the following update:
and fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release adds the following updates:
and fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release fixes the following CRITICAL SECURITY ISSUES: https://wekan.fi/hall-of-fame/bflableed/ :
and adds the following new features:
and adds the following updates:
and fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release adds the following new features:
and adds the following updates:
and fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release adds the following updates:
and fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release adds the following updates:
and fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release adds the following updates:
and fixes the following bugs:
Removed empty line from star board description at top bar of board, and added some space between icons and text
</details>Thanks to above GitHub users for their contributions and translators for their translations.
This release adds the following updates:
and fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release adds the following updates:
and fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release adds the following updates:
and fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release fixes the following CRITICAL SECURITY ISSUES of AuthBleed:
and adds the following updates:
and adds the following tests:
Thanks to above GitHub users for their contributions and translators for their translations.
This release adds the following updates:
<details> <summary><a href="https://github.com/wekan/wekan/commit/f7db51b457a771267ce381f294c8163fc0cad406">Release scripts: Add Snap Store scripts to list and publish revisions to channels, because…</a> Thanks to xet7.</summary>Release scripts: Add Snap Store scripts to list and publish revisions to channels, because snapcraft.io website currently does not work
</details>and fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release fixes the following CRITICAL SECURITY ISSUES of AvatarBleed:
and fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release adds the following updates:
Docs: Added firewall config for Internet access from LXD Ubuntu container at Fedora Asahi Linux Remix, because building Linux arm64 .zip bundle of WeKan
</details>and fixes the following bugs:
<details> <summary><a href="https://github.com/wekan/wekan/commit/7556b3ed8e29b9edd074c1dd8c03a9b804787523">Fix Snap Candidate WRITABLE_PATH directory permissions at Parallel Snap file path…</a> Thanks to xet7.</summary>Fix Snap Candidate WRITABLE_PATH directory permissions at Parallel Snap file path /var/snap/wekan_SOMENAME/common/files/
</details>Thanks to above GitHub users for their contributions and translators for their translations.
This release adds the following updates:
and fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
This release adds the following updates:
and fixes the following bugs:
Fix Cannot delete card checklist title, by removing "Delete" and "Convert to Card" that belong to Checklist Items only. Checklist Menu already has Delete Checklist
</details>Thanks to above GitHub users for their contributions and translators for their translations.