Wekan vulnerabilities
36 CVEs and advisories name Wekan as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-119300Wekan: ReDoS via Unescaped User Input in RegExp
- CVE-2026-68901WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service
- CVE-2026-68900Wekan: Stored XSS in HTML board exports through a card-title second parse
- CVE-2026-68899Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback
- CVE-2026-68561Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule
- CVE-2026-68560Wekan:hell Injection in External Antivirus Scanner Path via asyncExec
- CVE-2026-68558Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)
- CVE-2026-68559Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)
- CVE-2026-55652Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)
- CVE-2026-55234Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)
- CVE-2026-53447Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID
- CVE-2026-52893Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook
- CVE-2026-53444Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin
- CVE-2026-53445Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards
- CVE-2026-53446Wekan: Server-Side Request Forgery (SSRF) via webhook integration URLs
- CVE-2026-52892Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops)
- CVE-2026-52891Wekan: Shell Injection via Avatar Upload
- CVE-2026-52890Wekan: Arbitrary file read and server DoS via attachment versions.original.path
- CVE-2026-59154Wekan: Checklist direct DDP updates can write checklist data into private boards
- CVE-2026-41455WeKan < 8.35 SSRF via Webhook URL
- CVE-2026-41454WeKan < 8.35 Missing Authorization via Integration REST API
- CVE-2026-30847Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens
- CVE-2026-30846Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication
- CVE-2026-30845Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication
- CVE-2026-30844Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading
- CVE-2026-30843Wekan has Cross-Board IDOR in Custom Fields Update Endpoints
- CVE-2026-25859WeKan < 8.20 Migration Functionality Insufficient Permission Checks
- CVE-2026-25568WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass
- CVE-2026-25567WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId
- CVE-2026-25566WeKan < 8.19 Cross-board Card Move Without Destination Authorization