Advisories · Technology
wekan.
Every CVE that names wekan among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Wekan: ReDoS via Unescaped User Input in RegExp
- wekan
- Denial of service
- CVSS 6.5 Medium
WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service
- wekan
- Memory corruption
- CVSS 7.6 High
Wekan: Stored XSS in HTML board exports through a card-title second parse
- wekan
- Cross-site scripting (XSS)
- CVSS 8.7 High
Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback
- wekan
- Unrestricted file upload
- CVSS 8.8 High
Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule
- wekan
- Privilege escalation
- Broken access control
- CVSS 7.7 High
Wekan:hell Injection in External Antivirus Scanner Path via asyncExec
- wekan
- Command injection
- CVSS 8.5 High
Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)
- wekan
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)
- wekan
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)
- wekan
- Authentication bypass
- CVSS 8.5 High
Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)
- wekan
- Broken access control
- CVSS 6.5 Medium
Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID
- wekan
- Broken access control
- CVSS 9.2 CriticalCritical · CVSS 9+
Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook
- wekan
- Authentication bypass
- CVSS 7.6 High
Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin
- wekan
- Privilege escalation
- Broken access control
- CVSS 7.1 High
Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards
- wekan
- Broken access control
- CVSS 6.2 Medium
Wekan: Server-Side Request Forgery (SSRF) via webhook integration URLs
- wekan
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops)
- wekan
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Wekan: Shell Injection via Avatar Upload
- wekan
- Command injection
- CVSS 7.1 High
Wekan: Arbitrary file read and server DoS via attachment versions.original.path
- wekan
- Path traversal
- Denial of service
- CVSS 4.3 Medium
Wekan: Checklist direct DDP updates can write checklist data into private boards
- wekan
- Broken access control
- CVSS 6.3 Medium
WeKan < 8.35 SSRF via Webhook URL
- wekan
- Server-side request forgery (SSRF)
- CVSS 8.7 High
WeKan < 8.35 Missing Authorization via Integration REST API
- wekan
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens
- Wekan
- Information disclosure
- Broken access control
- CVSS 8.7 High
Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication
- Wekan
- Information disclosure
- Authentication bypass
- CVSS 6.9 Medium
Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication
- Wekan
- Information disclosure
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading
- Wekan
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
Wekan has Cross-Board IDOR in Custom Fields Update Endpoints
- Wekan
- Broken access control
- CVSS 5.3 Medium
WeKan Custom Translation translationBody.js setCreateTranslation improper authorization
- WeKan
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
WeKan Rules rules.js RulesBleed authorization
- WeKan
- Broken access control
- CVSS 6.9 Medium
WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure
- WeKan
- Information disclosure
- Broken access control
- CVSS 5.3 Medium
WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control
- WeKan
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
WeKan Meteor Publication cards.js CardPubSubBleed information disclosure
- WeKan
- Information disclosure
- Broken access control
- CVSS 7.1 High
WeKan < 8.20 Migration Functionality Insufficient Permission Checks
- WeKan
- Broken access control
- CVSS 7.1 High
WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass
- WeKan
- Broken access control
- CVSS 5.3 Medium
WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId
- WeKan
- Broken access control
- CVSS 7.1 High
WeKan < 8.19 Cross-board Card Move Without Destination Authorization
- WeKan
- Broken access control
- CVSS 7.1 High
WeKan < 8.19 Read-only Board Roles Can Update Cards
- WeKan
- Broken access control
- CVSS 7.1 High
WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation
- WeKan
- Broken access control
- CVSS 7.1 High
WeKan < 8.19 Checklist Creation Cross-Board IDOR
- WeKan
- Broken access control
- CVSS 5.3 Medium
WeKan < 8.19 Attachments Publication Information Disclosure
- WeKan
- Information disclosure
- CVSS 7.1 High
WeKan < 8.19 Attachment Upload Object Relationship Validation Bypass
- WeKan
- Broken access control
- CVSS 8.7 High
WeKan < 8.19 LDAP Authentication Filter Injection
- WeKan
- Other injection
- CVSS 5.3 Medium
WeKan REST Endpoint boards.js BoardTitleRESTBleed access control
- WeKan
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
WeKan Attachment Storage attachments.js MoveStorageBleed access control
- WeKan
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control
- WeKan
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
WeKan LDAP User Sync syncUser.js SyncLDAPBleed access control
- WeKan
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
WeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorization
- WeKan
- Broken access control
- CVSS 5.3 Medium
WeKan Migration Operation comprehensiveBoardMigration.js ComprehensiveBoardMigration MigrationBleed access control
- WeKan
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
WeKan Attachment Storage lists.js applyWipLimit ListWIPBleed access control
- WeKan
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
WeKan REST API checklistItems.js Checklist REST Bleed improper authorization
- WeKan
- Privilege escalation
- Broken access control
- CVSS 2.3 Low
WeKan REST API boards.js setBoardOrgs improper authorization
- WeKan
- Privilege escalation
- Broken access control
-
Cross-site scripting in Wekan
- Wekan
- Cross-site scripting (XSS)