Missing Authorization in Wekan - #VU150006
Published: September 15, 2026
Vulnerability identifier: #VU150006
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to delete attachments and avatars across an instance.
The vulnerability exists due to missing authorization in the server-registered _FilesCollectionRemove_attachments and _FilesCollectionRemove_avatars DDP methods when handling unauthenticated DDP method calls. A remote attacker can invoke the methods with an empty selector to delete attachment records and physical files or avatar records.
Deleting avatars also clears each user\'s profile.avatarUrl value.
Affected software
Wekan
Remediation
Install security update from vendor's website.
Wekan - update to 11.65