Read the docs
TI-2026-83217 Aliases CVE-2026-119300

Regular expression denial of service in Wekan user search

Priority MEDIUM 62CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1333.

Summary

Wekan before 11.11 is affected. The user-search publication and the searchUsers method pass user-supplied search terms to new RegExp() without escaping regular-expression metacharacters, which is CWE-1333. An authenticated user can submit catastrophic-backtracking patterns on MongoDB-backed deployments, consuming database CPU and degrading or denying service to other users. FerretDB v1 deployments using RE2 are not practically affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. MongoDB-backed deployments evaluate the resulting patterns with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users; searchUsers additionally requires board membership or site-admin status. The FerretDB v1 / RE2 unaffected configuration is not practically affected by catastrophic backtracking. This issue is fixed in version 11.11.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00295 22nd percentileScored 2026-11-07
Fix Fixed wekan (wekan): 11.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wekanwekanbefore 11.1111.11Patch availableCNA
  • wekan Vendorwekan Affected before 11.11 Fixed in 11.11 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*——wekan
  • cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:* Versions — — ·wekan

Remediation

Upgrade Wekan to version 11.11, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA wekan (wekan) Fixed in 11.11

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119300
  2. 2026-11-01 Priority changed: MEDIUM → LOW
  3. 2026-11-04 CISA SSVC decision points changed
  4. 2026-11-04 Priority changed: LOW → MEDIUM

References

Other 3

  • TI-2026-40177 Improper authentication in wekan CVSS 3.1CRITICAL 9.8
  • TI-2026-37989 Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook CVSS 4.0CRITICAL 9.2
  • TI-2026-48308 Improper privilege management in wekan CVSS 3.1HIGH 8.8
  • TI-2026-48305 Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446) CVSS 3.1HIGH 8.5
  • TI-2026-39911 Improper access control in wekan CVSS 3.1HIGH 8.5
  • TI-2026-01855 WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure CVSS 4.0MEDIUM 6.9
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences