# wekan.

Every CVE that names wekan among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Wekan: ReDoS via Unescaped User Input in RegExp](https://agentprime.io/advisories/CVE-2026-119300.md)
  `CVE-2026-119300` · CVE record: wekan wekan · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service
- [WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service](https://agentprime.io/advisories/CVE-2026-68901.md)
  `CVE-2026-68901` · CVE record: wekan wekan · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [Wekan: Stored XSS in HTML board exports through a card-title second parse](https://agentprime.io/advisories/CVE-2026-68900.md)
  `CVE-2026-68900` · CVE record: wekan wekan · CVSS 7.6 High · Not analysed yet · Published 19 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback](https://agentprime.io/advisories/CVE-2026-68899.md)
  `CVE-2026-68899` · CVE record: wekan wekan · CVSS 8.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: Unrestricted file upload
- [Wekan: a low-privilege board member escalates to board admin and takes over a private board via the \`sort\` collection-allow rule](https://agentprime.io/advisories/CVE-2026-68561.md)
  `CVE-2026-68561` · CVE record: wekan wekan · CVSS 8.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Privilege escalation, Broken access control
- [Wekan:hell Injection in External Antivirus Scanner Path via asyncExec](https://agentprime.io/advisories/CVE-2026-68560.md)
  `CVE-2026-68560` · CVE record: wekan wekan · CVSS 7.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection
- [Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)](https://agentprime.io/advisories/CVE-2026-68558.md)
  `CVE-2026-68558` · CVE record: wekan wekan · CVSS 8.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Wekan: Broken access control in the Excel-export route (\`/api/boards/:boardId/exportExcel\`)](https://agentprime.io/advisories/CVE-2026-68559.md)
  `CVE-2026-68559` · CVE record: wekan wekan · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Broken access control
- [Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)](https://agentprime.io/advisories/CVE-2026-55652.md)
  `CVE-2026-55652` · CVE record: wekan wekan · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2026 · Tags: Authentication bypass
- [Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)](https://agentprime.io/advisories/CVE-2026-55234.md)
  `CVE-2026-55234` · CVE record: wekan wekan · CVSS 8.5 High · Not analysed yet · Published 15 Jul 2026 · Tags: Broken access control
- [Wekan: \`cloneBoard\` Meteor method has no authorization check — any user can clone (read) any private board by ID](https://agentprime.io/advisories/CVE-2026-53447.md)
  `CVE-2026-53447` · CVE record: wekan wekan · CVSS 6.5 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Broken access control
- [Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook](https://agentprime.io/advisories/CVE-2026-52893.md)
  `CVE-2026-52893` · CVE record: wekan wekan · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2026 · Tags: Authentication bypass
- [Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin](https://agentprime.io/advisories/CVE-2026-53444.md)
  `CVE-2026-53444` · CVE record: wekan wekan · CVSS 7.6 High · Not analysed yet · Published 15 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards](https://agentprime.io/advisories/CVE-2026-53445.md)
  `CVE-2026-53445` · CVE record: wekan wekan · CVSS 7.1 High · Not analysed yet · Published 15 Jul 2026 · Tags: Broken access control
- [Wekan: Server-Side Request Forgery (SSRF) via webhook integration URLs](https://agentprime.io/advisories/CVE-2026-53446.md)
  `CVE-2026-53446` · CVE record: wekan wekan · CVSS 6.2 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Server-side request forgery (SSRF)
- [Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops)](https://agentprime.io/advisories/CVE-2026-52892.md)
  `CVE-2026-52892` · CVE record: wekan wekan · CVSS 6.5 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Broken access control
- [Wekan: Shell Injection via Avatar Upload](https://agentprime.io/advisories/CVE-2026-52891.md)
  `CVE-2026-52891` · CVE record: wekan wekan · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2026 · Tags: Command injection
- [Wekan: Arbitrary file read and server DoS via attachment versions.original.path](https://agentprime.io/advisories/CVE-2026-52890.md)
  `CVE-2026-52890` · CVE record: wekan wekan · CVSS 7.1 High · Not analysed yet · Published 15 Jul 2026 · Tags: Path traversal, Denial of service
- [Wekan: Checklist direct DDP updates can write checklist data into private boards](https://agentprime.io/advisories/CVE-2026-59154.md)
  `CVE-2026-59154` · CVE record: wekan wekan · CVSS 4.3 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Broken access control
- [WeKan < 8.35 SSRF via Webhook URL](https://agentprime.io/advisories/CVE-2026-41455.md)
  `CVE-2026-41455` · CVE record: wekan wekan · CVSS 6.3 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [WeKan < 8.35 Missing Authorization via Integration REST API](https://agentprime.io/advisories/CVE-2026-41454.md)
  `CVE-2026-41454` · CVE record: wekan wekan · CVSS 8.7 High · Not analysed yet · Published 22 Apr 2026 · Tags: Broken access control
- [Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens](https://agentprime.io/advisories/CVE-2026-30847.md)
  `CVE-2026-30847` · CVE record: Wekan Wekan · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Mar 2026 · Tags: Information disclosure, Broken access control
- [Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication](https://agentprime.io/advisories/CVE-2026-30846.md)
  `CVE-2026-30846` · CVE record: Wekan Wekan · CVSS 8.7 High · Not analysed yet · Published 6 Mar 2026 · Tags: Information disclosure, Authentication bypass
- [Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication](https://agentprime.io/advisories/CVE-2026-30845.md)
  `CVE-2026-30845` · CVE record: Wekan Wekan · CVSS 6.9 Medium · Not analysed yet · Published 6 Mar 2026 · Tags: Information disclosure, Broken access control
- [Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading](https://agentprime.io/advisories/CVE-2026-30844.md)
  `CVE-2026-30844` · CVE record: Wekan Wekan · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Wekan has Cross-Board IDOR in Custom Fields Update Endpoints](https://agentprime.io/advisories/CVE-2026-30843.md)
  `CVE-2026-30843` · CVE record: Wekan Wekan · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Mar 2026 · Tags: Broken access control
- [WeKan Custom Translation translationBody.js setCreateTranslation improper authorization](https://agentprime.io/advisories/CVE-2026-2209.md)
  `CVE-2026-2209` · CVE record: WeKan · CVSS 5.3 Medium · Not analysed yet · Published 8 Feb 2026 · Tags: Privilege escalation, Broken access control
- [WeKan Rules rules.js RulesBleed authorization](https://agentprime.io/advisories/CVE-2026-2208.md)
  `CVE-2026-2208` · CVE record: WeKan · CVSS 5.3 Medium · Not analysed yet · Published 8 Feb 2026 · Tags: Broken access control
- [WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure](https://agentprime.io/advisories/CVE-2026-2207.md)
  `CVE-2026-2207` · CVE record: WeKan · CVSS 6.9 Medium · Not analysed yet · Published 8 Feb 2026 · Tags: Information disclosure, Broken access control
- [WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control](https://agentprime.io/advisories/CVE-2026-2206.md)
  `CVE-2026-2206` · CVE record: WeKan · CVSS 5.3 Medium · Not analysed yet · Published 8 Feb 2026 · Tags: Privilege escalation, Broken access control
- [WeKan Meteor Publication cards.js CardPubSubBleed information disclosure](https://agentprime.io/advisories/CVE-2026-2205.md)
  `CVE-2026-2205` · CVE record: WeKan · CVSS 5.3 Medium · Not analysed yet · Published 8 Feb 2026 · Tags: Information disclosure, Broken access control
- [WeKan < 8.20 Migration Functionality Insufficient Permission Checks](https://agentprime.io/advisories/CVE-2026-25859.md)
  `CVE-2026-25859` · CVE record: WeKan WeKan · CVSS 7.1 High · Not analysed yet · Published 7 Feb 2026 · Tags: Broken access control
- [WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass](https://agentprime.io/advisories/CVE-2026-25568.md)
  `CVE-2026-25568` · CVE record: WeKan WeKan · CVSS 7.1 High · Not analysed yet · Published 7 Feb 2026 · Tags: Broken access control
- [WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId](https://agentprime.io/advisories/CVE-2026-25567.md)
  `CVE-2026-25567` · CVE record: WeKan WeKan · CVSS 5.3 Medium · Not analysed yet · Published 7 Feb 2026 · Tags: Broken access control
- [WeKan < 8.19 Cross-board Card Move Without Destination Authorization](https://agentprime.io/advisories/CVE-2026-25566.md)
  `CVE-2026-25566` · CVE record: WeKan WeKan · CVSS 7.1 High · Not analysed yet · Published 7 Feb 2026 · Tags: Broken access control
- [WeKan < 8.19 Read-only Board Roles Can Update Cards](https://agentprime.io/advisories/CVE-2026-25565.md)
  `CVE-2026-25565` · CVE record: WeKan WeKan · CVSS 7.1 High · Not analysed yet · Published 7 Feb 2026 · Tags: Broken access control
- [WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation](https://agentprime.io/advisories/CVE-2026-25564.md)
  `CVE-2026-25564` · CVE record: WeKan WeKan · CVSS 7.1 High · Not analysed yet · Published 7 Feb 2026 · Tags: Broken access control
- [WeKan < 8.19 Checklist Creation Cross-Board IDOR](https://agentprime.io/advisories/CVE-2026-25563.md)
  `CVE-2026-25563` · CVE record: WeKan WeKan · CVSS 7.1 High · Not analysed yet · Published 7 Feb 2026 · Tags: Broken access control
- [WeKan < 8.19 Attachments Publication Information Disclosure](https://agentprime.io/advisories/CVE-2026-25562.md)
  `CVE-2026-25562` · CVE record: WeKan WeKan · CVSS 5.3 Medium · Not analysed yet · Published 7 Feb 2026 · Tags: Information disclosure
- [WeKan < 8.19 Attachment Upload Object Relationship Validation Bypass](https://agentprime.io/advisories/CVE-2026-25561.md)
  `CVE-2026-25561` · CVE record: WeKan WeKan · CVSS 7.1 High · Not analysed yet · Published 7 Feb 2026 · Tags: Broken access control
- [WeKan < 8.19 LDAP Authentication Filter Injection](https://agentprime.io/advisories/CVE-2026-25560.md)
  `CVE-2026-25560` · CVE record: WeKan WeKan · CVSS 8.7 High · Not analysed yet · Published 7 Feb 2026 · Tags: Other injection
- [WeKan REST Endpoint boards.js BoardTitleRESTBleed access control](https://agentprime.io/advisories/CVE-2026-1964.md)
  `CVE-2026-1964` · CVE record: WeKan · CVSS 5.3 Medium · Not analysed yet · Published 5 Feb 2026 · Tags: Privilege escalation, Broken access control
- [WeKan Attachment Storage attachments.js MoveStorageBleed access control](https://agentprime.io/advisories/CVE-2026-1963.md)
  `CVE-2026-1963` · CVE record: WeKan · CVSS 5.3 Medium · Not analysed yet · Published 5 Feb 2026 · Tags: Privilege escalation, Broken access control
- [WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control](https://agentprime.io/advisories/CVE-2026-1962.md)
  `CVE-2026-1962` · CVE record: WeKan · CVSS 5.3 Medium · Not analysed yet · Published 5 Feb 2026 · Tags: Privilege escalation, Broken access control
- [WeKan LDAP User Sync syncUser.js SyncLDAPBleed access control](https://agentprime.io/advisories/CVE-2026-1898.md)
  `CVE-2026-1898` · CVE record: WeKan · CVSS 5.3 Medium · Not analysed yet · Published 5 Feb 2026 · Tags: Privilege escalation, Broken access control
- [WeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorization](https://agentprime.io/advisories/CVE-2026-1897.md)
  `CVE-2026-1897` · CVE record: WeKan · CVSS 5.3 Medium · Not analysed yet · Published 5 Feb 2026 · Tags: Broken access control
- [WeKan Migration Operation comprehensiveBoardMigration.js ComprehensiveBoardMigration MigrationBleed access control](https://agentprime.io/advisories/CVE-2026-1896.md)
  `CVE-2026-1896` · CVE record: WeKan · CVSS 5.3 Medium · Not analysed yet · Published 4 Feb 2026 · Tags: Privilege escalation, Broken access control
- [WeKan Attachment Storage lists.js applyWipLimit ListWIPBleed access control](https://agentprime.io/advisories/CVE-2026-1895.md)
  `CVE-2026-1895` · CVE record: WeKan · CVSS 5.3 Medium · Not analysed yet · Published 4 Feb 2026 · Tags: Privilege escalation, Broken access control
- [WeKan REST API checklistItems.js Checklist REST Bleed improper authorization](https://agentprime.io/advisories/CVE-2026-1894.md)
  `CVE-2026-1894` · CVE record: WeKan · CVSS 5.3 Medium · Not analysed yet · Published 4 Feb 2026 · Tags: Privilege escalation, Broken access control
- [WeKan REST API boards.js setBoardOrgs improper authorization](https://agentprime.io/advisories/CVE-2026-1892.md)
  `CVE-2026-1892` · CVE record: WeKan · CVSS 2.3 Low · Not analysed yet · Published 4 Feb 2026 · Tags: Privilege escalation, Broken access control
- [Cross-site scripting in Wekan](https://agentprime.io/advisories/CVE-2021-20654.md)
  `CVE-2021-20654` · CVE record: Wekan Team Wekan · No CVSS score · Not analysed yet · Published 10 Feb 2021 · Tags: Cross-site scripting (XSS)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=wekan>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/wekan/>. Everything for agents: <https://agentprime.io/llms.txt>.