Authorization bypass through user-controlled key in Wekan - CVE-2026-55234
Published: July 28, 2026
Vulnerability identifier: #VU139854
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55234
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify data in a private board they are not a member of.
The vulnerability exists due to improper access control in the DDP update allow rules for cards, lists, and swimlanes when processing update requests that change the boardId field. A remote user can send a specially crafted DDP update request to modify data in a private board they are not a member of.
The issue affects the auto-generated Meteor collection methods for cards, lists, and swimlanes over the websocket interface, and the destination board membership is not validated during these updates.
Affected software
Wekan
How to mitigate CVE-2026-55234
Install security update from vendor's website.
Wekan - update to 9.37