SB2026081867 - Multiple vulnerabilities in Wekan

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081867

SB2026081867 - Multiple vulnerabilities in Wekan

Published: August 18, 2026

Security Bulletin ID SB2026081867
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose low-sensitivity board metadata.

The vulnerability exists due to improper access control in the GET /api/users/{userId}/boards endpoint when handling board listing requests for a user whose membership was revoked. A remote user can request their own board listing to disclose low-sensitivity board metadata.

The exposure is limited to the board id and title, and title changes remain visible after membership is deactivated. Access to board contents is still denied.


2) Unverified Ownership (CVE-ID: N/A)

CWE-ID: CWE-283 - Unverified Ownership

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to falsify activity attribution for card creations, card deletions, and custom-field creations.

The vulnerability exists due to unverified ownership in authorId request-body handling in card and custom-field API endpoints when processing authenticated board write requests. A remote user can supply a crafted authorId value to falsify activity attribution for card creations, card deletions, and custom-field creations.

The issue affects board activity history and recorded document ownership on boards the user can write to.


3) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information from private board cards.

The vulnerability exists due to incorrect authorization in GET /api/user/cards when processing card membership and assignee entries without re-checking board access. A remote user can read the aggregated \"my cards\" feed after being added to a card\'s members or assignees array to disclose sensitive information from private board cards.

The issue is persistent while the unauthorized membership entry remains present, and it affects card titles, board, list, and swimlane identifiers, dates, and co-member information.


4) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information in the GET /api/users/{userId} and PUT /api/users/{userId} endpoints when serializing complete Meteor user documents without field projection. A remote privileged user can send a request to those endpoints for arbitrary users to disclose sensitive information.

Only instances with WITH_API=true are vulnerable. Exposed data includes password bcrypt hashes and hashes of active session tokens for arbitrary users.


5) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to delete card-related data across boards.

The vulnerability exists due to authorization bypass through user-controlled key in the single-card DELETE endpoint when handling a request that supplies an accessible board ID in the URL and a foreign card ID in the path. A remote user can send a crafted DELETE request to delete card-related data across boards.

Deletion is irreversible, the targeted card itself may remain present, and the endpoint can return HTTP 200 even when only the related comments, checklists, checklist items, activities, and subcards were removed. Only deployments with WITH_API=true are vulnerable.


Remediation

Install update from vendor's website.

References