Incorrect authorization in Wekan - #VU144218
Published: August 18, 2026
Vulnerability identifier: #VU144218
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information from private board cards.
The vulnerability exists due to incorrect authorization in GET /api/user/cards when processing card membership and assignee entries without re-checking board access. A remote user can read the aggregated \"my cards\" feed after being added to a card\'s members or assignees array to disclose sensitive information from private board cards.
The issue is persistent while the unauthorized membership entry remains present, and it affects card titles, board, list, and swimlane identifiers, dates, and co-member information.
Affected software
Wekan
Remediation
Install security update from vendor's website.
Wekan - update to 10.92