Vulnerabilities

TI-2026-23676 CVE-2026-30847

Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens

MEDIUM 40

Wekan is an open source kanban tool built with Meteor.

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.00268 Published 2026-03-06 Fixed in 8.34 CWE-200

TI-2026-23675 CVE-2026-30846

Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication

MEDIUM 44

Wekan is an open source kanban tool built with Meteor.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00392 Published 2026-03-06 Fixed in 8.34 CWE-200

TI-2026-23674 CVE-2026-30845

Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication

LOW 36

Wekan is an open source kanban tool built with Meteor.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00337 Published 2026-03-06 Fixed in 8.34 CWE-200

TI-2026-23673 CVE-2026-30844

Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading

MEDIUM 42

Wekan is an open source kanban tool built with Meteor.

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.00268 Published 2026-03-06 Fixed in 8.34 CWE-918

TI-2026-23672 CVE-2026-30843

Wekan has Cross-Board IDOR in Custom Fields Update Endpoints

MEDIUM 42

Wekan is an open source kanban tool built with Meteor.

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.00248 Published 2026-03-06 Fixed in 8.34 CWE-639

TI-2026-01857 CVE-2026-2209 · GHSA-2hfm-wh8p-mfqm

WeKan Custom Translation translationBody.js setCreateTranslation improper authorization

LOW 23

A vulnerability was detected in WeKan up to 8.18.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00224 Published 2026-02-08 Fixed in 8.19 CWE-266

TI-2026-01856 CVE-2026-2208 · GHSA-wxr4-4cp2-2mqr

WeKan Rules rules.js RulesBleed authorization

LOW 24

A security vulnerability has been detected in WeKan up to 8.20.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0029 Published 2026-02-08 Fixed in 8.21 CWE-862

TI-2026-01855 CVE-2026-2207 · GHSA-p69q-x7rq-85qp

WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure

HIGH 70

A weakness has been identified in WeKan up to 8.20.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00407 Published 2026-02-08 Fixed in 8.21 CWE-200

TI-2026-01854 CVE-2026-2206 · GHSA-97mf-v96f-5jp7

WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control

LOW 24

A security flaw has been discovered in WeKan up to 8.20.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00284 Published 2026-02-08 Fixed in 8.21 CWE-266

TI-2026-01853 CVE-2026-2205 · GHSA-xvv7-73jx-5wcg

WeKan Meteor Publication cards.js CardPubSubBleed information disclosure

LOW 24

A vulnerability was identified in WeKan up to 8.20.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00279 Published 2026-02-08 Fixed in 8.21 CWE-200

TI-2026-20903 CVE-2026-25859 · GHSA-gp3c-fxmq-6r3c

WeKan < 8.20 Migration Functionality Insufficient Permission Checks

LOW 31

Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in unauthorized migration operations.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00381 Published 2026-02-07 Fixed in 8.20 CWE-863

TI-2026-20675 CVE-2026-25568 · GHSA-mxjf-259r-3r76

WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass

LOW 31

WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforced at board creation time.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00225 Published 2026-02-07 Fixed in 8.19 CWE-863

TI-2026-20674 CVE-2026-25567 · GHSA-9w3f-qqh3-w7fc

WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId

LOW 24

WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00273 Published 2026-02-07 Fixed in 8.19 CWE-639

TI-2026-20673 CVE-2026-25566 · GHSA-62j7-j842-x6r6

WeKan < 8.19 Cross-board Card Move Without Destination Authorization

LOW 31

WeKan versions prior to 8.19 contain an authorization vulnerability in card move logic.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00247 Published 2026-02-07 Fixed in 8.19 CWE-863

TI-2026-20672 CVE-2026-25565 · GHSA-7c8j-xhpq-ww8c

WeKan < 8.19 Read-only Board Roles Can Update Cards

LOW 31

WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring write permission.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00307 Published 2026-02-07 Fixed in 8.19 CWE-863

TI-2026-20671 CVE-2026-25564 · GHSA-xc4h-36v7-xrrw

WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation

LOW 31

WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00311 Published 2026-02-07 Fixed in 8.19 CWE-639

TI-2026-20670 CVE-2026-25563 · GHSA-x9cj-242h-gr3m

WeKan < 8.19 Checklist Creation Cross-Board IDOR

LOW 31

WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00314 Published 2026-02-07 Fixed in 8.19 CWE-639

TI-2026-20669 CVE-2026-25562 · GHSA-4h56-xmq8-7hc9

WeKan < 8.19 Attachments Publication Information Disclosure

LOW 30

WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00321 Published 2026-02-07 Fixed in 8.19 CWE-203

TI-2026-20668 CVE-2026-25561 · GHSA-5q4r-452w-ggwq

WeKan < 8.19 Attachment Upload Object Relationship Validation Bypass

LOW 33

WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00314 Published 2026-02-07 Fixed in 8.19 CWE-863

TI-2026-20667 CVE-2026-25560 · GHSA-gmrw-vh4q-4fvv

WeKan < 8.19 LDAP Authentication Filter Injection

MEDIUM 47

WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00732 Published 2026-02-07 Fixed in 8.19 CWE-90

TI-2026-01623 CVE-2026-1964 · GHSA-p668-4pcg-fgmf

WeKan REST Endpoint boards.js BoardTitleRESTBleed access control

LOW 24

A vulnerability was determined in WeKan up to 8.20.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00259 Published 2026-02-05 Fixed in 8.21 CWE-266

TI-2026-01622 CVE-2026-1963 · GHSA-38wp-738r-69jh

WeKan Attachment Storage attachments.js MoveStorageBleed access control

LOW 24

A vulnerability was found in WeKan up to 8.20.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00358 Published 2026-02-05 Fixed in 8.21 CWE-266

TI-2026-01621 CVE-2026-1962 · GHSA-w6f3-6jw4-9h89

WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control

LOW 24

A vulnerability has been found in WeKan up to 8.20.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00358 Published 2026-02-05 Fixed in 8.21 CWE-266

TI-2026-01564 CVE-2026-1898 · GHSA-ccch-v5jp-xrrh

WeKan LDAP User Sync syncUser.js SyncLDAPBleed access control

LOW 24

A vulnerability was determined in WeKan up to 8.20.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00295 Published 2026-02-05 Fixed in 8.21 CWE-266

TI-2026-01563 CVE-2026-1897 · GHSA-4xx4-65hp-28vf

WeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorization

LOW 24

A vulnerability was found in WeKan up to 8.20.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00333 Published 2026-02-05 Fixed in 8.21 CWE-862

Vulnerabilities

Filters