Read the docs
TI-2026-23676 Aliases CVE-2026-30847

Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens

Priority MEDIUM 40CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-285.

Summary

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the notificationUsers publication in Wekan publishes user documents with no field filtering, causing the ReactiveCache.getUsers() call to return all fields including highly sensitive data such as bcrypt password hashes, active session login tokens, email verification tokens, full email addresses, and any stored OAuth tokens. Unlike Meteor's default auto-publication which strips the services field for security, custom publications return whatever fields the cursor contains, meaning all subscribers receive the complete user documents. Any authenticated user who triggers this publication can harvest credentials and active session tokens for other users, enabling password cracking, session hijacking, and full account takeover. This issue has been fixed in version 8.34.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00268 19th percentileScored 2026-11-07
Fix Fixed Wekan (Wekan): 8.34

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wekanWekan8.31.0 to before 8.348.34Patch availableCNA
  • Wekan Vendorwekan Affected 8.31.0 to before 8.34 Fixed in 8.34 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*8.31 to before 8.33Vulnerablewekan
  • cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:* Versions 8.31 to before 8.33 Vulnerable ·wekan

Remediation

  • Fix · CNA Wekan (Wekan) Fixed in 8.34

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-30847

References

Patch 1

Advisory 1

Other 1

  • TI-2026-01855 WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure CVSS 4.0MEDIUM 6.9
  • TI-2023-13025 A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before… CVSS 3.1MEDIUM 5.4
  • TI-2026-20667 WeKan < 8.19 LDAP Authentication Filter Injection CVSS 4.0HIGH 8.7
  • TI-2026-23675 Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication CVSS 4.0HIGH 8.7
  • TI-2026-23673 Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading CVSS 4.0CRITICAL 9.3
  • TI-2026-23672 Wekan has Cross-Board IDOR in Custom Fields Update Endpoints CVSS 4.0CRITICAL 9.3
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences