Read the docs
TI-2026-23675 Aliases CVE-2026-30846

Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication

Priority MEDIUM 44CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-306.

Summary

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the globalwebhooks publication exposes all global webhook integrations—including sensitive url and token fields—without performing any authentication check on the server side. Although the subscription is normally invoked from the admin settings page, the server-side publication has no access control, meaning any DDP client, including unauthenticated ones, can subscribe and receive the data. This allows an unauthenticated attacker to retrieve global webhook URLs and authentication tokens, potentially enabling unauthorized use of those webhooks and access to connected external services. This issue has been fixed in version 8.34.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00392 33rd percentileScored 2026-11-07
Fix Fixed Wekan (Wekan): 8.34

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wekanWekan8.31.0 to before 8.348.34Patch availableCNA
  • Wekan Vendorwekan Affected 8.31.0 to before 8.34 Fixed in 8.34 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*8.31 to before 8.33Vulnerablewekan
  • cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:* Versions 8.31 to before 8.33 Vulnerable ·wekan

Remediation

  • Fix · CNA Wekan (Wekan) Fixed in 8.34

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-30846
  2. 2026-10-23 EPSS moved to the 50th–90th percentile
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 1

Advisory 1

Other 1

  • TI-2026-01855 WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure CVSS 4.0MEDIUM 6.9
  • TI-2023-13025 A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before… CVSS 3.1MEDIUM 5.4
  • TI-2026-20667 WeKan < 8.19 LDAP Authentication Filter Injection CVSS 4.0HIGH 8.7
  • TI-2026-23673 Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading CVSS 4.0CRITICAL 9.3
  • TI-2026-23672 Wekan has Cross-Board IDOR in Custom Fields Update Endpoints CVSS 4.0CRITICAL 9.3
  • TI-2025-40439 An issue was discovered in Wekan The Open Source kanban board system up to version 18.15… CVSS 3.1HIGH 8.2
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences