SB2026072857 - Authorization bypass through user-controlled key in Wekan

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072857

SB2026072857 - Authorization bypass through user-controlled key in Wekan

Published: July 28, 2026

Security Bulletin ID SB2026072857
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-55234)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to modify data in a private board they are not a member of.

The vulnerability exists due to improper access control in the DDP update allow rules for cards, lists, and swimlanes when processing update requests that change the boardId field. A remote user can send a specially crafted DDP update request to modify data in a private board they are not a member of.

The issue affects the auto-generated Meteor collection methods for cards, lists, and swimlanes over the websocket interface, and the destination board membership is not validated during these updates.


Remediation

Install update from vendor's website.

References