SB2026072862 - Multiple vulnerabilities in Wekan

Description

This security bulletin contains information about 3 vulnerabilities.

1) Missing Authorization (CVE-ID: CVE-2026-52892)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to modify board custom fields and dropdown items.

The vulnerability exists due to improper access control in the custom fields REST handlers in server/models/customFields.js when handling authenticated mutating API requests for board custom fields. A remote user can send crafted POST, PUT, or DELETE requests to modify board custom fields and dropdown items.

Only instances with WITH_API=true are vulnerable. The issue is limited to boards where the user is already a read-only member.

2) Improper Authentication (CVE-ID: CVE-2026-52893)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to take over another user's account.

The vulnerability exists due to improper authentication in the Accounts.onCreateUser hook in server/models/users.js when processing OIDC login claims that match an existing user's email address or username. A remote attacker can authenticate through the configured OIDC provider with specially crafted claims to take over another user's account.

Only deployments with OIDC authentication enabled are vulnerable. No victim interaction is required, and administrative accounts can also be taken over.

3) Missing Authorization (CVE-ID: CVE-2026-53444)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to escalate privileges to global admin.

The vulnerability exists due to missing authorization in the groupRoutineOnLogin Meteor method and addGroupsWithAttributes login handling when handling caller-supplied OIDC group data and user identifiers. A remote user can call the exposed method with crafted group attributes to escalate privileges to global admin.

Exploitation requires the PROPAGATE_OIDC_DATA environment variable to be enabled.

Remediation

Install update from vendor's website.

References

• https://github.com/wekan/wekan/security/advisories/GHSA-6733-4wgq-8xvr
• https://github.com/wekan/wekan/security/advisories/GHSA-mp7g-hj5q-gxhq
• https://github.com/wekan/wekan/security/advisories/GHSA-cv95-8h7c-2ffq