Title: Wekan <8.21 Information disclosure via publish/subscribe authorization bug Description: The Meteor publication for individual cards did not adequately ensure the requesting user could view the parent board before returning card data. The fix adds early returns when card/board is missing and enforces board visibility checks prior to publishing card data. Source:  User: MegaManSec (UID 94702) Submission: 02/04/2026 05:56 PM (3 days ago) Moderation: 02/08/2026 02:06 AM (3 days later) Status: Accepted VulDB entry: !VulDB entry [WeKan up to 8.20 Meteor Publication cards.js CardPubSubBleed information disclosure] Points:** 17