SB2026082523 - Multiple vulnerabilities in Wekan
Published: August 25, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify or delete organization and team configuration records.
The vulnerability exists due to improper access control in the Meteor DDP allow rules for the org and team collections when handling insert, update, or remove operations on documents whose _id matches the caller\'s user ID. A remote user can send crafted DDP method requests to modify or delete organization and team configuration records.
The issue affects authenticated non-admin users and does not require organization or team administration privileges, membership, tenant scoping, or a field-level allowlist.
2) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to create arbitrary cards on a board.
The vulnerability exists due to incorrect authorization in the importIcsToBoard Meteor method in server/methods/icsImport.js when processing ICS import requests. A remote user can invoke the import method with crafted ICS content to create arbitrary cards on a board.
The issue affects comment-only board members and is limited to intra-board integrity impact, with no observed cross-board access or confidentiality impact.
3) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify card content.
The vulnerability exists due to incorrect authorization in the REST API card update endpoint when handling authenticated card modification requests. A remote user can send a crafted PUT request for an unassigned card to modify card content.
No cross-board access, confidentiality impact, or site-administrator escalation was observed during testing.
Remediation
Install update from vendor's website.