Read the docs
TI-2026-42320 Aliases CVE-2026-59154

Wekan: Checklist direct DDP updates can write checklist data into private boards

Priority LOW 20CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Wekan is open source kanban built with Meteor. Prior to 9.64, Wekan has a cross-board authorization bypass in the direct Meteor collection allow rules for Checklists and ChecklistItems because updates are authorized only against the current source doc.cardId and do not inspect the destination cardId or boardId in the update modifier, allowing a low-privileged authenticated user with write access to one board and knowledge of a target private card id to create checklist data on an accessible card and move it into a private board where they are not a member. This issue is fixed in version 9.64.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00358 29th percentileScored 2026-11-07
Fix Fixed wekan (wekan): 9.64

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wekanwekanbefore 9.649.64Patch availableCNA
  • wekan Vendorwekan Affected before 9.64 Fixed in 9.64 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*——wekan
  • cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:* Versions — — ·wekan

Remediation

  • Fix · CNA wekan (wekan) Fixed in 9.64

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59154

References

Other 3

  • TI-2026-40177 Improper authentication in wekan CVSS 3.1CRITICAL 9.8
  • TI-2026-37989 Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook CVSS 4.0CRITICAL 9.2
  • TI-2026-48308 Improper privilege management in wekan CVSS 3.1HIGH 8.8
  • TI-2026-48305 Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446) CVSS 3.1HIGH 8.5
  • TI-2026-39911 Improper access control in wekan CVSS 3.1HIGH 8.5
  • TI-2026-01855 WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure CVSS 4.0MEDIUM 6.9
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences