Wekan
CVE-2026-25859
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-priv user over the network invokes unguarded migration methods, so PR:L/AC:L/AV:N; impact is integrity-focused (I:H) with minor availability (A:L) and no confidentiality loss.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
8DescriptionCVE.org
Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in unauthorized migration operations.
AnalysisAI
Broken authorization in Wekan versions prior to 8.20 lets any authenticated non-administrative user invoke board migration functionality that should be restricted to board administrators. Because permission checks on the migration methods (e.g. comprehensiveBoardMigration.execute) are insufficient, a low-privileged user can trigger unauthorized migration operations that mutate board structure and data. EPSS is very low (0.05%, 15th percentile) and there is no public exploit identified at time of analysis, but a vendor patch and fix commit are available.
Technical ContextAI
Wekan is a self-hosted, open-source kanban board built on the Meteor JavaScript framework (Node.js + MongoDB), the affected product per CPE cpe:2.3:a:wekan_project:wekan:*. The root cause maps to CWE-863 (Incorrect Authorization): server-side Meteor methods that drive board migration/conversion (the diff references comprehensiveBoardMigration.needsMigration and comprehensiveBoardMigration.execute, plus a client-side migrationManager) did not enforce that the caller holds board-admin privileges. The patch commit (cbb1cd78de3e40264a5e047ace0ce27f8635b4e6) removes automatic migration on board load and refactors migrations so they are only run manually from the sidebar Migrations menu by board admins, swaps the old client migrationManager for an attachmentMigrationManager, and relocates migrationProgress under settings - indicating the fix centralizes and gates the migration trigger rather than exposing it to every board viewer.
RemediationAI
Vendor-released patch: upgrade to Wekan 8.20 or later, which restricts migration functionality to board administrators and disables automatic migration (fix commit https://github.com/wekan/wekan/commit/cbb1cd78de3e40264a5e047ace0ce27f8635b4e6). If you cannot upgrade immediately, reduce exposure by restricting Wekan account provisioning to trusted users and reviewing which users hold board access, since exploitation requires an authenticated low-privileged account - shrinking the authenticated user population directly shrinks the attack surface, at the cost of collaboration convenience. Monitor server logs for unexpected calls to migration/conversion methods and unexpected board-structure changes so unauthorized migration operations can be detected and rolled back. See the VulnCheck advisory (https://www.vulncheck.com/advisories/wekan-migration-functionality-insufficient-permission-checks) and vendor site (https://wekan.fi/) for release details.
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by t
OS command injection in Wekan (the open-source Meteor-based kanban board) before version 9.07 lets an authenticated user
Authentication bypass in Wekan (open-source Meteor kanban) before version 9.46 lets an unauthenticated attacker imperson
A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticate
Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scrip
Account takeover in Wekan (open-source Meteor kanban) before 9.32 allows an attacker who controls an OIDC provider accou
Privilege escalation in Wekan open-source kanban (all versions prior to 9.89, dubbed 'SortBleed') allows any board membe
Stored XSS in Wekan prior to v9.90 allows authenticated board members to upload HTML containing JavaScript disguised as
LDAP filter injection in WeKan before 8.19 allows remote unauthenticated attackers to manipulate LDAP search filters and
Privilege escalation in WeKan (versions prior to 8.35) allows authenticated board members with low privileges to perform
Improper access control in Wekan (self-hosted open-source Meteor kanban) before version 9.37 lets any authenticated user
Wekan's outgoing webhook URL validator in versions 8.36 through 9.73 allows authenticated board members to bypass SSRF p
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today