# cve.now: Wekan

The newest entries naming Wekan as an affected vendor (up to 200), of 36 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119300](https://cve.now/CVE-2026-119300.md): Wekan: ReDoS via Unescaped User Input in RegExp (CVSS 6.5)
- [CVE-2026-68901](https://cve.now/CVE-2026-68901.md): WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service (CVSS 6.5)
- [CVE-2026-68900](https://cve.now/CVE-2026-68900.md): Wekan: Stored XSS in HTML board exports through a card-title second parse (CVSS 7.6)
- [CVE-2026-68899](https://cve.now/CVE-2026-68899.md): Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback (CVSS 8.7)
- [CVE-2026-68561](https://cve.now/CVE-2026-68561.md): Wekan: a low-privilege board member escalates to board admin and takes over a private board via the \`sort\` collection-allow rule (CVSS 8.8)
- [CVE-2026-68560](https://cve.now/CVE-2026-68560.md): Wekan:hell Injection in External Antivirus Scanner Path via asyncExec (CVSS 7.7)
- [CVE-2026-68558](https://cve.now/CVE-2026-68558.md): Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446) (CVSS 8.5)
- [CVE-2026-68559](https://cve.now/CVE-2026-68559.md): Wekan: Broken access control in the Excel-export route (\`/api/boards/:boardId/exportExcel\`) (CVSS 6.5)
- [CVE-2026-55652](https://cve.now/CVE-2026-55652.md): Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin) (CVSS 9.8)
- [CVE-2026-55234](https://cve.now/CVE-2026-55234.md): Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule) (CVSS 8.5)
- [CVE-2026-53447](https://cve.now/CVE-2026-53447.md): Wekan: \`cloneBoard\` Meteor method has no authorization check — any user can clone (read) any private board by ID (CVSS 6.5)
- [CVE-2026-52893](https://cve.now/CVE-2026-52893.md): Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook (CVSS 9.2)
- [CVE-2026-53444](https://cve.now/CVE-2026-53444.md): Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin (CVSS 7.6)
- [CVE-2026-53445](https://cve.now/CVE-2026-53445.md): Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards (CVSS 7.1)
- [CVE-2026-53446](https://cve.now/CVE-2026-53446.md): Wekan: Server-Side Request Forgery (SSRF) via webhook integration URLs (CVSS 6.2)
- [CVE-2026-52892](https://cve.now/CVE-2026-52892.md): Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops) (CVSS 6.5)
- [CVE-2026-52891](https://cve.now/CVE-2026-52891.md): Wekan: Shell Injection via Avatar Upload (CVSS 9.9)
- [CVE-2026-52890](https://cve.now/CVE-2026-52890.md): Wekan: Arbitrary file read and server DoS via attachment versions.original.path (CVSS 7.1)
- [CVE-2026-59154](https://cve.now/CVE-2026-59154.md): Wekan: Checklist direct DDP updates can write checklist data into private boards (CVSS 4.3)
- [CVE-2026-41455](https://cve.now/CVE-2026-41455.md): WeKan \< 8.35 SSRF via Webhook URL (CVSS 6.3)
- [CVE-2026-41454](https://cve.now/CVE-2026-41454.md): WeKan \< 8.35 Missing Authorization via Integration REST API (CVSS 8.7)
- [CVE-2026-30847](https://cve.now/CVE-2026-30847.md): Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens (CVSS 9.3)
- [CVE-2026-30846](https://cve.now/CVE-2026-30846.md): Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication (CVSS 8.7)
- [CVE-2026-30845](https://cve.now/CVE-2026-30845.md): Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication (CVSS 6.9)
- [CVE-2026-30844](https://cve.now/CVE-2026-30844.md): Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading (CVSS 9.3)
- [CVE-2026-30843](https://cve.now/CVE-2026-30843.md): Wekan has Cross-Board IDOR in Custom Fields Update Endpoints (CVSS 9.3)
- [CVE-2026-25859](https://cve.now/CVE-2026-25859.md): WeKan \< 8.20 Migration Functionality Insufficient Permission Checks (CVSS 7.1)
- [CVE-2026-25568](https://cve.now/CVE-2026-25568.md): WeKan \< 8.19 allowPrivateOnly Setting Enforcement Bypass (CVSS 7.1)
- [CVE-2026-25567](https://cve.now/CVE-2026-25567.md): WeKan \< 8.19 Card Comment Author Spoofing via User-controlled authorId (CVSS 5.3)
- [CVE-2026-25566](https://cve.now/CVE-2026-25566.md): WeKan \< 8.19 Cross-board Card Move Without Destination Authorization (CVSS 7.1)
- [CVE-2026-25565](https://cve.now/CVE-2026-25565.md): WeKan \< 8.19 Read-only Board Roles Can Update Cards (CVSS 7.1)
- [CVE-2026-25564](https://cve.now/CVE-2026-25564.md): WeKan \< 8.19 Checklist Deletion IDOR via Missing Relationship Validation (CVSS 7.1)
- [CVE-2026-25563](https://cve.now/CVE-2026-25563.md): WeKan \< 8.19 Checklist Creation Cross-Board IDOR (CVSS 7.1)
- [CVE-2026-25562](https://cve.now/CVE-2026-25562.md): WeKan \< 8.19 Attachments Publication Information Disclosure (CVSS 5.3)
- [CVE-2026-25561](https://cve.now/CVE-2026-25561.md): WeKan \< 8.19 Attachment Upload Object Relationship Validation Bypass (CVSS 7.1)
- [CVE-2026-25560](https://cve.now/CVE-2026-25560.md): WeKan \< 8.19 LDAP Authentication Filter Injection (CVSS 8.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wekan
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.