SB2026081864 - Multiple vulnerabilities in Wekan
Published: August 18, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Authorization bypass through user-controlled key (CVE-ID: N/A)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to delete other users\' comments.
The vulnerability exists due to incorrect authorization in the REST DELETE /api/boards/:boardId/cards/:cardId/comments/:commentId endpoint when handling comment deletion requests. A remote user can send a crafted DELETE request to delete other users\' comments.
The issue affects board members and can bypass the author-or-admin comment deletion policy, including when restrictCommentEditing is enabled.
2) Path traversal (CVE-ID: N/A)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information from arbitrary files.
The vulnerability exists due to path traversal in board export avatar embed logic when processing an exported board containing an avatar with a client-modified versions.original.path value. A remote user can update avatar metadata to reference an arbitrary filesystem path and export a board to disclose sensitive information from arbitrary files.
The exposed file contents are embedded as base64 in users[].profile.avatarFile, and the readable scope is limited to files accessible to the Wekan process.
3) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to missing authorization in the board publication ancestor card handling when processing cross-board parentId relationships. A remote user can set a card\'s parentId to a card on another board to disclose sensitive information.
Exploitation requires write access on the child board and knowledge of a card identifier from another board.
4) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to incorrect authorization in Meteor.publish(\'board\') in server/publications/boards.js when handling board subscription requests for a known boardId. A remote user can subscribe to a revoked org, team, or domain-shared private board to disclose sensitive information.
The issue occurs after a board share has been revoked by setting isActive to false, and users who retained the boardId can still receive the full private board payload. The same behavior applies to organization, team, and domain share arrays.
Remediation
Install update from vendor's website.