Security Fix 3: Card comment author spoofing (IDOR) via API.

Thanks to Joshua Rogers of joshua.hu, Twitter MegaManSec !
2026-02-04 15:41:52 +01:00 · 2025-12-29 16:34:00 +02:00 · 2025-12-29 16:34:00 +02:00 · 67cb47173c
commit 67cb47173c
parent 7ed76c180e
2 changed files with 3 additions and 10 deletions
--- a/public/api/wekan.yml
+++ b/public/api/wekan.yml
@ -1115,12 +1115,6 @@ paths:
        - multipart/form-data
        - application/json
      parameters:
-        - name: authorId
-          in: formData
-          description: |
-            the user who 'posted' the comment
-          type: string
-          required: true
        - name: comment
          in: formData
          description: the comment value