SB2026082526 - Multiple vulnerabilities in Wekan

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082526

SB2026082526 - Multiple vulnerabilities in Wekan

Published: August 25, 2026

Security Bulletin ID SB2026082526
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 57% Low 43%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the user-search DDP publication when handling subscription requests. A remote user can subscribe with a wildcard search pattern to disclose sensitive information.

The issue exposes email addresses, admin status, disabled status, authentication methods, and org or team memberships across the entire instance without board-level scoping.


2) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the user-search DDP publication when processing a user-supplied regular expression. A remote user can submit repeated subscriptions with a crafted regex pattern to cause a denial of service.

The search term is passed directly to RegExp construction without sanitization, enabling catastrophic backtracking during database regex evaluation.


3) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to missing authentication for the user-miniprofile Meteor DDP publication in server/publications/users.js when handling unauthenticated WebSocket subscription requests. A remote attacker can subscribe to the user-miniprofile publication with supplied usernames to disclose sensitive information.

Exposed data may include org and team membership, authentication method, last connection date, and migration-era usernames.


4) Inefficient regular expression complexity (CVE-ID: N/A)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in the user-search publication and searchUsers Meteor method when processing user-supplied search queries. A remote user can send a crafted search query containing catastrophic-backtracking regular expressions to cause a denial of service.

Only deployments using an external MongoDB backend are practically affected; deployments using the bundled FerretDB v1 SQLite backend are not practically exploitable. The searchUsers method additionally requires active board membership or site-admin status, while the user-search publication requires only a logged-in session.


5) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to inject a card they control into an arbitrary private board and disclose limited board structure information.

The vulnerability exists due to authorization bypass through a user-controlled key in the UserPositionHistory insert allow rule and undo() helper when processing a crafted userPositionHistory record and undo request. A remote user can insert a crafted history entry with an attacker-controlled previousBoardId and invoke undo to inject a card they control into an arbitrary private board and disclose limited board structure information.

The injected card may contain attacker-authored title, description, custom fields, and attachments, and it becomes visible in the victim board activity feed. Supplying valid previousListId or previousSwimlaneId values is required, and errors may reveal target board structure.


6) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in subtaskItems export queries across the board export endpoints when exporting a public board. A remote user can set the parentId field on a private card to reference a card on a public board and then download the public board export to disclose sensitive information.

All five export formats are affected, and no user interaction is required.


7) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to take over an existing account.

The vulnerability exists due to improper authentication in the CAS login handler in packages/wekan-accounts-cas/cas_server.js when processing CAS-authenticated logins with a username matching an existing local account. A remote user can authenticate through the configured CAS server with a matching username to take over an existing account.

Only instances with CAS enabled are vulnerable, and no victim interaction is required.


Remediation

Install update from vendor's website.

References