Authorization bypass through user-controlled key in Wekan - #VU150009
Published: September 15, 2026
Vulnerability identifier: #VU150009
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain unauthorized access to private boards.
The vulnerability exists due to improper access control in the sendInvitation method when submitting an invitation with a private board ID. A remote user can submit an invitation containing an arbitrary private board ID to gain unauthorized access to private boards.
Exploitation requires registration to be disabled and mailDomainName to be configured.
Affected software
Wekan
Remediation
Install security update from vendor's website.
Wekan - update to 11.77