SB2026091569 - Multiple vulnerabilities in Wekan

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091569

SB2026091569 - Multiple vulnerabilities in Wekan

Published: September 15, 2026

Security Bulletin ID SB2026091569
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 14
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 14 vulnerabilities.


1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to create public boards despite a private-only visibility policy.

The vulnerability exists due to incorrect authorization in the createBoardWithInitialSwimlanes method when creating a board through a DDP method call. A remote user can submit a board-creation request with public permission to create public boards despite a private-only visibility policy.

Exploitation requires the allowPrivateOnly visibility setting to be enabled.


2) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to gain unauthorized access to private boards.

The vulnerability exists due to improper access control in the sendInvitation method when submitting an invitation with a private board ID. A remote user can submit an invitation containing an arbitrary private board ID to gain unauthorized access to private boards.

Exploitation requires registration to be disabled and mailDomainName to be configured.


3) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify source cards without source-board write access.

The vulnerability exists due to incorrect authorization in the linked-card permission handling when creating a linked card on an attacker-controlled destination board. A remote user can create a linked card and submit an update to the source card to modify source cards without source-board write access.

The user must be a comment-only member of the source board and have write access to the destination board.


4) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to regain access to a private board after removal.

The vulnerability exists due to improper authorization in the acceptInvite method when processing a client-writable profile.invitedBoards value. A remote user can add a private board identifier to their profile.invitedBoards array and invoke acceptInvite to regain access to a private board after removal.

Exploitation is limited to users whose existing board membership record was deactivated rather than removed.


5) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify board settings.

The vulnerability exists due to incorrect authorization in the REST board management endpoints when handling requests from normal board members. A remote user can send requests to update a board title or card settings, or create, modify, or delete board rules to modify board settings.

Board rules can configure automation that later runs as trusted server code.


6) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to move a list\'s cards to another board and archive the list without source-board write permission.

The vulnerability exists due to incorrect authorization in the moveList Meteor method when moving a list between boards. A remote user can invoke moveList while having membership on the source board and write access on the destination board to move a list\'s cards to another board and archive the list without source-board write permission.

Exploitation requires comment-only membership on the source board.


7) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to move swimlanes without write permission.

The vulnerability exists due to incorrect authorization in the moveSwimlane Meteor method when moving swimlanes. A remote user can invoke moveSwimlane with source-board membership to move swimlanes without write permission.

Comment-only members are among the affected roles.


8) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to reparent checklists without write permission.

The vulnerability exists due to incorrect authorization in the moveChecklist Meteor method when moving a checklist between cards. A remote user can invoke moveChecklist while being a member associated with both cards to reparent checklists without write permission.

The user interface normally hides this operation behind canModifyCard.


9) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify imported data without write permission.

The vulnerability exists due to incorrect authorization in the importScoped Meteor method when importing scoped data. A remote user can invoke importScoped after passing visibility and board-membership checks to modify imported data without write permission.


10) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to rename attachments without write permission.

The vulnerability exists due to incorrect authorization in the renameAttachment Meteor method when renaming an attachment. A remote user can invoke renameAttachment with board membership to rename attachments without write permission.


11) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to restore historical changes without write permission.

The vulnerability exists due to incorrect authorization in the changeHistory restore operation when restoring historical changes. A remote user can invoke the restore operation while passing its membership check to restore historical changes without write permission.

The membership check excludes comment-only members but does not exclude read-only, worker, or comment-assigned-only roles.


12) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify cards on private boards.

The vulnerability exists due to authorization bypass through a user-controlled key in the rules.runButton method when invoking a button rule with an unbound card ID. A remote user can invoke the method with a rule ID from one board and a card ID from another board to modify cards on private boards.

The user only needs comment-only or read-only membership on the board containing the rule.


13) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose private-board card information.

The vulnerability exists due to authorization bypass through a user-controlled key in the comment creation endpoint when submitting a comment request with a card ID belonging to another board. A remote user can create a comment associated with a private-board card to disclose private-board card information.

Lazy DDP publication can make the injected comment visible in the victim interface on large boards.


14) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and modify data on an unauthorized board.

The vulnerability exists due to authorization bypass through a user-controlled key in the subtasksDefaultBoardId handling and board publication scope when setting a source board\'s subtasksDefaultBoardId to another board identifier. A remote user can set the identifier to a board they cannot access and subscribe to the source board to receive cards and related board content from the other board.

Content may be disclosed to all subscribers of the source board, including anonymous users when that board is public.


Remediation

Install update from vendor's website.

References