Wekan CVE-2026-119300

Requires an authenticated DDP session as any logged-in user for Sink 1 (the 'user-search' publication); Sink 2 (the 'searchUsers' method) additionally requires active board membership or site-admin status, and queries under 2 characters are rejected. Exploitation further requires a MongoDB backend whose PCRE2 engine permits catastrophic backtracking - the default on amd64/arm64 Docker and all bare-metal installs. Deployments using the bundled FerretDB v1 / RE2 (Go linear-time regex) backend, default only on ppc64le/s390x/riscv64, are not practically affected. Meaningful denial of service requires issuing several concurrent crafted requests (a single query only costs ~400-700 ms); pre-11.11 there is no DDP rate limiting on either endpoint. Only balanced catastrophic patterns work - unbalanced patterns throw a SyntaxError in Node before reaching the database.

This is a genuine but moderate-priority availability issue rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5) is internally consistent with the evidence: network-reachable DDP endpoints, low complexity, and low-privilege authentication (any logged-in user) with availability-only impact. The vuln.today decision label is 'this_month' - not 'act_now' or 'emergency' - which aligns with a self-hosted DoS bug that requires an authenticated account and only degrades availability. No EPSS score was provided in the input, so exploitation-probability modeling cannot be incorporated - this is a data gap, not a low score. The CVE is NOT listed in CISA KEV and there is no claim of active exploitation; however, the vendor's GHSA advisory embeds a complete, measured proof-of-concept (poc-redos.mjs) with reproducible timings (~400-700 ms mongod CPU per crafted query, ~15 s DB saturation from 30 parallel requests), so working exploit code is effectively public. A key scoping caveat: impact is backend-dependent - only MongoDB/PCRE2 deployments (the default on amd64/arm64 and all bare-metal installs) are exploitable, while FerretDB v1/RE2 deployments are not practically affected. The A:H rating is justified only under concurrency; a single request alone does not deny service. Net: a real, easily reproduced internal DoS that warrants prompt patching, but gated by authentication and backend choice rather than a widely-weaponized remote-unauthenticated threat.

A logged-in Wekan user on a MongoDB-backed instance opens a raw DDP WebSocket and subscribes to the 'user-search' publication with a balanced catastrophic-backtracking pattern such as '(a+)'.repeat(10)+'$'. Because the search term is passed to new RegExp() without escaping, MongoDB's PCRE2 engine evaluates the pattern against every candidate user, burning hundreds of milliseconds of database CPU per request; firing a few dozen concurrent requests saturates mongod for many seconds and denies service to all other users. A complete, measured public PoC for this exact path is published in the vendor's GHSA advisory.