SB2026081863 - Multiple vulnerabilities in Wekan
Published: August 18, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Information Exposure Through Timing Discrepancy (CVE-ID: N/A)
CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to enumerate valid user accounts.
The vulnerability exists due to an observable timing discrepancy in the accounts-password login flow when processing login attempts for existing and non-existing users. A remote attacker can send specially crafted login requests and measure response times to enumerate valid user accounts.
Password-based login must be enabled for exploitation of this issue.
2) Improper Restriction of Excessive Authentication Attempts (CVE-ID: N/A)
CWE-ID: CWE-307 - Improper Restriction of Excessive Authentication Attempts
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to take over user accounts.
The vulnerability exists due to improper restriction of excessive authentication attempts in the wekan-accounts-lockout login protection hooks when handling password-based login failures through the DDP login method. A remote attacker can send repeated password-guessing requests to take over user accounts.
The issue depends on Meteor replacing granular login failure reasons with the generic \"Login forbidden\" response, which prevents the failure counter from incrementing and leaves the built-in lockout inactive.
Remediation
Install update from vendor's website.