important · Privilege
Disabling a WeKan account did not revoke its API or attachment access.
Affects
WeKan, a self-hosted collaborative kanban server commonly deployed in containers.
REST login ignored loginDisabled, and existing bearer or cookie tokens remained usable after an administrator disabled the identity.
Detail and 2 sources
The reporter and maintainer verified corrected revocation behavior before release.