SB2026082524 - Multiple vulnerabilities in Wekan

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082524

SB2026082524 - Multiple vulnerabilities in Wekan

Published: August 25, 2026

Security Bulletin ID SB2026082524
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify checklists, checklist items, and comments beyond intended board-role restrictions.

The vulnerability exists due to incorrect authorization in REST API checklist, checklist-item, and comment write endpoints when handling authenticated write requests. A remote user can send crafted REST API requests to modify checklists, checklist items, and comments beyond intended board-role restrictions.

The issue affects authenticated board members with low-privilege roles such as read-only, read-assigned-only, and comment-assigned-only, and the REST routes do not apply assignment-based scoping for these operations.


2) Information Exposure Through an Error Message (CVE-ID: N/A)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to generation of error messages containing sensitive information in REST API error handlers in server/models/users.js and server/models/boards.js when handling crafted API requests that trigger catch blocks. A remote user can send a specially crafted request to disclose sensitive information.

Error conditions are returned as HTTP 200 responses with serialized error objects, and non-serializable errors may produce a corrupted {\"_id\":{}} response that can act as an error oracle.


3) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to create cards and checklists without write permission.

The vulnerability exists due to improper authorization in card creation and checklist creation REST endpoints when handling authenticated API requests from restricted board members. A remote user can send crafted POST requests to create cards and checklists without write permission.

The issue affects members assigned the comment-only, comment-assigned-only, or worker roles on boards where those roles have comment capability but explicitly lack write capability.


4) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify or delete checklist items and checklists.

The vulnerability exists due to improper authorization in checklist item and checklist REST endpoints when handling authenticated mutation requests from read-only or comment-only board members. A remote user can send crafted POST, PUT, or DELETE requests to modify or delete checklist items and checklists.

The issue affects API clients because the REST layer checks board membership with checkBoardAccess instead of enforcing write permission, while the DDP/Meteor layer correctly applies write restrictions.


5) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to create boards under another user\'s account.

The vulnerability exists due to authorization bypass through a user-controlled key in the POST /api/boards endpoint when handling crafted board-creation requests. A remote user can supply a crafted owner field in the request body to create boards under another user\'s account.

The created board appears in the victim\'s board list with the victim as the sole admin, while the requester is not added as a member of that board.


6) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to take over arbitrary user accounts.

The vulnerability exists due to authorization bypass through a user-controlled key in the POST /api/createtoken/:userId endpoint when handling requests with an attacker-controlled userId path parameter. A remote privileged user can send a crafted request to generate a valid login token for any user and take over arbitrary user accounts.

The generated token is functionally identical to a normal login token and bypasses the impersonation audit trail.


Remediation

Install update from vendor's website.

References