Improper Authorization in Wekan - #VU145027
Published: August 25, 2026
Vulnerability identifier: #VU145027
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify or delete checklist items and checklists.
The vulnerability exists due to improper authorization in checklist item and checklist REST endpoints when handling authenticated mutation requests from read-only or comment-only board members. A remote user can send crafted POST, PUT, or DELETE requests to modify or delete checklist items and checklists.
The issue affects API clients because the REST layer checks board membership with checkBoardAccess instead of enforcing write permission, while the DDP/Meteor layer correctly applies write restrictions.
Affected software
Wekan
Remediation
Install security update from vendor's website.
Wekan - update to 11.08