@@ -235,6 +235,10 @@ const CATALOG = {
   // GHSA-6xqf-jh8x-4wxc: an assigned-only member archiving or converting a card
   // not assigned to them through archiveSelectedCards / createBoardFromCard.
   'authz.assigned-card-write': { category: 'authz', bleed: 'UnassignedArchiveBleed', severity: 'medium', cwe: 'CWE-863' },
+  // GHSA-4734-8vrg-8j3w: a REST write in a list whose exception refuses the
+  // caller's role (#4527). The web UI offers no such write, so it is the lock
+  // being stepped round with a token. Medium: recorded, never disables.
+  'authz.list-locked': { category: 'authz', bleed: 'ListLockBleed', severity: 'medium', cwe: 'CWE-863' },
   'authz.tenant':    { category: 'authz', bleed: 'TenantBleed', severity: 'medium', cwe: 'CWE-862' },
   'authz.search-session': { category: 'authz', bleed: 'SessionBleed', severity: 'medium', cwe: 'CWE-639' },
   'authz.database':  { category: 'authz', bleed: 'DatabaseBleed', severity: 'high', cwe: 'CWE-863' },
 
@@ -33,9 +33,19 @@ export async function canCommentInList(userId, board, listId) {
  * The REST API's half: a list that refuses this user's role refuses the API
  * too (403), so a restriction cannot be stepped round with a token. A list's
  * GRANT does not open the API to a role the board does not let write.
+ *
+ * ListLockBleed (GHSA-4734-8vrg-8j3w): the checklist and checklist-item routes
+ * did not ask, so a member a list refused still wrote its cards' checklists
+ * over REST. Every REST write that names a card asks now
+ * (tests/listPermissions.test.cjs), and the refusal is recorded in Admin
+ * Panel -> Problems: no screen offers such a write, so it is an attempt.
  */
-export async function assertListNotRefused(userId, board, listId, capability = 'write') {
+export async function assertListNotRefused(userId, board, listId, capability = 'write', source = 'rest:list-locked') {
   if ((await listException(userId, board, listId, capability)) !== false) return;
+  try {
+    require('/server/lib/securityLog').record({ key: 'authz.list-locked', action: 'blocked', source, userId,
+      detail: `A REST ${capability} in a list whose exception refuses the caller's role.` });
+  } catch (e) { /* logging must never break the guard */ }
   const { Meteor } = require('meteor/meteor');
   const error = new Meteor.Error('Forbidden', 'Forbidden');
   error.statusCode = 403;
 
@@ -3,6 +3,7 @@ import { Meteor } from 'meteor/meteor';
 import { WebApp } from 'meteor/webapp';
 import { Authentication } from '/server/authentication';
 import { sendJsonResult } from '/server/apiMiddleware';
+import { assertListNotRefused } from '/server/lib/listPermissionGate';
 import { ReactiveCache } from '/imports/reactiveCache';
 import ChecklistItems, {
   itemCreation,
@@ -145,6 +146,8 @@ WebApp.handlers.post(
     if (checklist) {
       const card = await ReactiveCache.getCard(paramCardId);
       if (card && card.boardId === paramBoardId) {
+        // ListLockBleed (GHSA-4734-8vrg-8j3w): the list's refusal holds over REST too (#4527).
+        await assertListNotRefused(req.userId, await ReactiveCache.getBoard(paramBoardId), card.listId, 'write', 'rest:checklist-item');
         // Append, like the UI does. Every item created over REST used to be given
         // `sort: 0`, so a checklist filled through the API came out in an order
         // nobody chose - and every item after the first shared the first one's
@@ -214,6 +217,8 @@ WebApp.handlers.put(
       });
       return;
     }
+    // ListLockBleed (GHSA-4734-8vrg-8j3w): the list's refusal holds over REST too (#4527).
+    await assertListNotRefused(req.userId, await ReactiveCache.getBoard(paramBoardId), card.listId, 'write', 'rest:checklist-item');
 
     const deadline = parseDueAt(req.body);
     if (deadline.error) {
@@ -277,6 +282,8 @@ WebApp.handlers.delete(
       });
       return;
     }
+    // ListLockBleed (GHSA-4734-8vrg-8j3w): the list's refusal holds over REST too (#4527).
+    await assertListNotRefused(req.userId, await ReactiveCache.getBoard(paramBoardId), card.listId, 'write', 'rest:checklist-item');
 
     await ChecklistItems.direct.removeAsync({ _id: paramItemId });
     sendJsonResult(res, {
 
@@ -1,6 +1,7 @@
 import { parseDueAt, checklistWithItems } from '/server/lib/checklistDeadlines';
 import { Meteor } from 'meteor/meteor';
 import { WebApp } from 'meteor/webapp';
+import { assertListNotRefused } from '/server/lib/listPermissionGate';
 import { Authentication } from '/server/authentication';
 import { sendJsonResult } from '/server/apiMiddleware';
 import { ReactiveCache } from '/imports/reactiveCache';
@@ -266,6 +267,8 @@ WebApp.handlers.post(
       });
       return;
     }
+    // ListLockBleed (GHSA-4734-8vrg-8j3w): the list's refusal holds over REST too (#4527).
+    await assertListNotRefused(req.userId, await ReactiveCache.getBoard(paramBoardId), card.listId, 'write', 'rest:checklist');
 
     const deadline = parseDueAt(req.body);
     if (deadline.error) {
@@ -335,6 +338,8 @@ WebApp.handlers.put(
       });
       return;
     }
+    // ListLockBleed (GHSA-4734-8vrg-8j3w): the list's refusal holds over REST too (#4527).
+    await assertListNotRefused(req.userId, await ReactiveCache.getBoard(paramBoardId), card.listId, 'write', 'rest:checklist');
 
     const checklist = await ReactiveCache.getChecklist({
       _id: paramChecklistId,
@@ -390,6 +395,8 @@ WebApp.handlers.delete(
       });
       return;
     }
+    // ListLockBleed (GHSA-4734-8vrg-8j3w): the list's refusal holds over REST too (#4527).
+    await assertListNotRefused(req.userId, await ReactiveCache.getBoard(paramBoardId), card.listId, 'write', 'rest:checklist');
 
     const checklist = await ReactiveCache.getChecklist({
       _id: paramChecklistId,
 
@@ -30,7 +30,9 @@ assert.equal(parseDueAt({ dueAt: '2026-09-15T14:30:00+02:00' }).dueAt.toISOStrin
  vm.runInNewContext(src.slice(start, end), {
   WebApp: { handlers: { put: (route, fn) => { handler = fn; } } }, parseDueAt,
   Authentication: { checkBoardWriteAccess: async () => { if (denied) throw Error('denied'); } },
-  ReactiveCache: { getCard: async () => wrongCard ? null : card, getChecklist: async () => ({ _id: 'check' }) },
+  ReactiveCache: { getCard: async () => wrongCard ? null : card, getChecklist: async () => ({ _id: 'check' }), getBoard: async () => ({ _id: 'board' }) },
+  // ListLockBleed's list check: tests/listPermissions.test.cjs pins it; here the list allows.
+  assertListNotRefused: async () => {},
   Checklists: { direct: { updateAsync: async (...args) => updates.push(args) } },
   sendJsonResult: (res, data) => { response = data; },
  });
@@ -51,7 +53,8 @@ assert.equal(parseDueAt({ dueAt: '2026-09-15T14:30:00+02:00' }).dueAt.toISOStrin
  vm.runInNewContext(itemSource.slice(itemStart, itemEnd), {
   WebApp: { handlers: { put: (route, fn) => { itemHandler = fn; } } }, parseDueAt,
   Authentication: { checkBoardWriteAccess: async () => {} },
-  ReactiveCache: { getChecklistItem: async () => ({ _id: 'item', cardId: 'card', checklistId: 'check' }), getCard: async () => ({ _id: 'card', boardId: 'board' }) },
+  ReactiveCache: { getChecklistItem: async () => ({ _id: 'item', cardId: 'card', checklistId: 'check' }), getCard: async () => ({ _id: 'card', boardId: 'board' }), getBoard: async () => ({ _id: 'board' }) },
+  assertListNotRefused: async () => {},
   ChecklistItems: { direct: { updateAsync: async (...args) => itemUpdates.push(args) } },
   sendJsonResult: (res, data) => { itemResponse = data; },
  });
 
@@ -57,7 +57,11 @@ function fixture() {
       getChecklistItems: async () => [],
       getCard: async id => cards[id] || null,
       getChecklist: async q => (checklists[q._id] && checklists[q._id].cardId === q.cardId ? checklists[q._id] : null),
+      getBoard: async id => ({ _id: id }),
     },
+    // ListLockBleed's list check (tests/listPermissions.test.cjs pins it); the
+    // lists of this fixture refuse nobody.
+    assertListNotRefused: async () => {},
     ChecklistItems: {
       insertAsync: async doc => { inserted.push(doc); return 'new'; },
       direct: {
 
@@ -130,6 +130,73 @@ test('the REST API honours a list\'s refusal on every per-list card route', () =
   assert.match(read('server/models/cardComments.js'), /canCommentInList\(req\.userId, board, card\.listId\)/, 'comments too');
 });
 
+// ListLockBleed (GHSA-4734-8vrg-8j3w): the checklist and checklist-item REST
+// routes asked only the board, so a member a list refused still wrote its
+// cards' checklists with a token. Not one route at a time: EVERY REST write in
+// the tree that names a card must ask the list - or be named here, with why.
+test('negative: every REST write that names a card asks the list (ListLockBleed)', () => {
+  const unrelated = {
+    // A comment's edit and deletion follow the comment's own rule (its author,
+    // or a board admin: assertCanMutateComment), on DDP as over REST; a list's
+    // comment refusal stops NEW comments, which the POST route asks.
+    'PUT /api/boards/:boardId/cards/:cardId/comments/:commentId': 'comment rule',
+    'DELETE /api/boards/:boardId/cards/:cardId/comments/:commentId': 'comment rule',
+    // Dependency lines have their own board-wide rule (canEditBoardDependencies),
+    // the same on DDP (setBoardDependency) as over REST.
+    'POST /api/boards/:boardId/cards/:cardId/dependencies': 'dependency rule',
+    'PUT /api/boards/:boardId/cards/:cardId/dependencies/:targetId': 'dependency rule',
+    'DELETE /api/boards/:boardId/cards/:cardId/dependencies/:targetId': 'dependency rule',
+    // A bot runner's report of its own run, written to BotRuns, not the card.
+    'POST /api/boards/:boardId/cards/:cardId/bot-runs/:runId': 'bot run report',
+  };
+  const found = [], missing = [];
+  const walk = dir => {
+    for (const entry of fs.readdirSync(path.join(ROOT, dir), { withFileTypes: true })) {
+      const rel = path.join(dir, entry.name);
+      if (entry.isDirectory()) { if (!['tests', 'node_modules'].includes(entry.name)) walk(rel); continue; }
+      if (!/\.js$/.test(entry.name)) continue;
+      const src = read(rel);
+      for (const m of src.matchAll(/WebApp\.handlers\.(post|put|delete|patch)\(\s*['"`]([^'"`]*:cardId[^'"`]*)['"`]/g)) {
+        const route = `${m[1].toUpperCase()} ${m[2]}`;
+        found.push(route);
+        const next = src.indexOf('WebApp.handlers.', m.index + 1);
+        let body = src.slice(m.index, next < 0 ? undefined : next);
+        const delegate = /await (\w+)\(req, res\b/.exec(body);
+        if (delegate) {
+          const start = src.indexOf(`async function ${delegate[1]}(`);
+          if (start >= 0) body += src.slice(start, src.indexOf('\n}\n', start));
+        }
+        if (!/assertListNotRefused\(|canWriteInList\(|canCommentInList\(/.test(body) && !unrelated[route]) missing.push(`${route} (${rel})`);
+      }
+    }
+  };
+  walk('server');
+  walk('models');
+  assert.ok(found.length >= 20, `the REST card write routes are found (${found.length})`);
+  for (const route of ['POST /api/boards/:boardId/cards/:cardId/checklists', 'PUT /api/boards/:boardId/cards/:cardId/checklists/:checklistId',
+    'DELETE /api/boards/:boardId/cards/:cardId/checklists/:checklistId', 'POST /api/boards/:boardId/cards/:cardId/checklists/:checklistId/items',
+    'PUT /api/boards/:boardId/cards/:cardId/checklists/:checklistId/items/:itemId',
+    'DELETE /api/boards/:boardId/cards/:cardId/checklists/:checklistId/items/:itemId']) {
+    assert.ok(found.includes(route), `${route} is scanned`);
+  }
+  assert.deepEqual(missing, []);
+  // The exceptions are real routes: a renamed one must be looked at again.
+  for (const route of Object.keys(unrelated)) assert.ok(found.includes(route), `${route} still exists`);
+});
+
+test('the refusal is recorded in Admin Panel -> Problems, and never breaks the guard (ListLockBleed)', () => {
+  const gate = read('server/lib/listPermissionGate.js');
+  const fn = gate.slice(gate.indexOf('export async function assertListNotRefused('));
+  assert.match(fn, /record\(\{ key: 'authz\.list-locked', action: 'blocked'/);
+  assert.match(fn, /catch \(e\) \{ \/\* logging must never break the guard \*\/ \}/);
+  // Recorded only on the refusal: after the early return of an allowed write.
+  assert.ok(fn.indexOf("!== false) return;") < fn.indexOf('record('), 'an allowed write records nothing');
+  const { categoryFor } = require('../models/lib/securityCategories');
+  const cat = categoryFor('authz.list-locked');
+  assert.equal(cat.bleed, 'ListLockBleed');
+  assert.equal(cat.severity, 'medium', 'recorded, never disables the account');
+});
+
 test('the client offers what the list allows', () => {
   const utils = read('client/lib/utils.js');
   assert.match(utils, /canModifyCard\([\s\S]*?return Utils\.currentUserCanInList\('write', card, board\);/);
 
@@ -0,0 +1,58 @@
+'use strict';
+// ListLockBleed (GHSA-4734-8vrg-8j3w): a list whose exception refuses a role
+// write (#4527) refuses that role's checklist and checklist-item writes over
+// REST too, and the attempt is in Admin Panel -> Problems. A list without the
+// refusal still takes the same writes.
+const { test, expect } = require('../fixtures');
+const db = require('../helpers/db');
+
+test('a list refusing a role write refuses its checklist REST writes (ListLockBleed)', async ({ request, board, user, user2 }) => {
+  const original = db.getBoard(board.boardId).members;
+  const [lockedListId, openListId] = board.listIds;
+  const card = id => db.find('cards', { boardId: board.boardId, listId: id })[0];
+  const locked = card(lockedListId), open = card(openListId);
+  const api = (method, url, data) => request[method](url, {
+    headers: { Authorization: `Bearer ${user2.token}`, 'Content-Type': 'application/json' }, ...(data ? { data } : {}) });
+  const recorded = () => db.findOne('eventlog', { bleed: 'ListLockBleed' })?.count || 0;
+  db.updateOne('boards', { _id: board.boardId }, { $set: { members: [...original.filter(m => m.userId !== user2.id),
+    { userId: user2.id, isActive: true, isAdmin: false }] } });
+  db.updateOne('lists', { _id: lockedListId }, { $set: { roleExceptions: { normal: { write: false } } } });
+  const checklist = { _id: db.uid('locked-checklist'), cardId: locked._id, title: 'Locked', sort: 0 };
+  const item = { _id: db.uid('locked-item'), cardId: locked._id, checklistId: checklist._id, title: 'Locked item', sort: 0, isFinished: false };
+  db.insertOne('checklists', checklist);
+  db.insertOne('checklistItems', item);
+  try {
+    const before = recorded();
+    const base = `/api/boards/${board.boardId}/cards/${locked._id}/checklists`;
+    for (const [method, url, data] of [
+      ['post', base, { title: 'x' }],
+      ['put', `${base}/${checklist._id}`, { title: 'renamed' }],
+      ['post', `${base}/${checklist._id}/items`, { title: 'new item' }],
+      ['put', `${base}/${checklist._id}/items/${item._id}`, { isFinished: 'true', title: 'changed' }],
+      ['delete', `${base}/${checklist._id}/items/${item._id}`],
+      ['delete', `${base}/${checklist._id}`],
+    ]) {
+      const res = await api(method, url, data);
+      expect(res.status(), `${method.toUpperCase()} ${url}`).toBe(403);
+    }
+    expect(db.find('checklists', { cardId: locked._id })).toEqual([expect.objectContaining({ _id: checklist._id, title: 'Locked' })]);
+    expect(db.find('checklistItems', { cardId: locked._id })).toEqual([expect.objectContaining({ _id: item._id, title: 'Locked item', isFinished: false })]);
+    expect(recorded()).toBeGreaterThan(before);
+    expect(db.findOne('users', { _id: user2.id }).loginDisabled || false).toBe(false);
+
+    // Negative: the same member writes the checklists of a list without the refusal.
+    const made = await api('post', `/api/boards/${board.boardId}/cards/${open._id}/checklists`, { title: 'Open', items: ['one'] });
+    expect(made.status()).toBe(200);
+    const openId = (await made.json())._id;
+    expect((await api('put', `/api/boards/${board.boardId}/cards/${open._id}/checklists/${openId}`, { title: 'Open renamed' })).status()).toBe(200);
+    expect((await api('delete', `/api/boards/${board.boardId}/cards/${open._id}/checklists/${openId}`)).status()).toBe(200);
+    // And the board admin, whom no list exception binds, writes the locked list's.
+    expect(admin.status()).toBe(200);
+  } finally {
+    db.updateOne('boards', { _id: board.boardId }, { $set: { members: original } });
+    db.updateOne('lists', { _id: lockedListId }, { $unset: { roleExceptions: '' } });
+    db.deleteMany('checklists', { cardId: { $in: [locked._id, open._id] } });
+    db.deleteMany('checklistItems', { cardId: { $in: [locked._id, open._id] } });
+  }
+});