Which versions of WeKan are affected by CVE-2026-41454?

WeKan versions prior to 8.35 contain a privilege escalation vulnerability that allows authenticated board members to bypass authorization controls and gain unauthorized administrative access to…. A patch is available.

How to fix or mitigate CVE-2026-41454?

Within 24 hours: Inventory all WeKan deployments and identify current versions. Within 7 days: Test and deploy WeKan 8.35 (including commit 2cd702f) across all environments, prioritizing production systems. Within 30 days: Audit integration access logs for the past 90 days to detect unauthorized administrative actions by low-privilege board members; review and reset all webhook secrets and integration credentials.

WeKan CVE-2026-41454

Q: What is the CVSS score of CVE-2026-41454?

CVE-2026-41454 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25117 HIGH

Missing Authorization (CWE-862)

2026-04-22 VulnCheck

GHSA-f2hf-mr43-85mv

Authentication Bypass Wekan

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 16:57 vuln.today

cvss_changed

Analysis Generated

Apr 23, 2026 - 06:56 vuln.today

CVSS changed

Apr 22, 2026 - 22:22 NVD

8.3 (HIGH) 8.7 (HIGH)

EUVD ID Assigned

Apr 22, 2026 - 21:46 euvd

EUVD-2026-25117

Analysis Generated

Apr 22, 2026 - 21:46 vuln.today

Patch released

Apr 22, 2026 - 21:46 nvd

Patch available

CVE Published

Apr 22, 2026 - 21:08 nvd

HIGH 8.7

DescriptionCVE.org

WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification. Attackers can enumerate integrations including webhook URLs, create new integrations, modify or delete existing integrations, and manage integration activities by exploiting insufficient authorization checks in the JsonRoutes REST handlers.

AnalysisAI

Privilege escalation in WeKan (versions prior to 8.35) allows authenticated board members with low privileges to perform administrative integration management without authorization checks. Attackers can enumerate webhook URLs and secrets, create/modify/delete integrations, and manipulate integration activities through unprotected REST API endpoints. CVSS 8.7 reflects high confidentiality and integrity impact with network attack vector and low complexity. VulnCheck reported this vulnerability with vendor patch available in version 8.35 and commit 2cd702f. EPSS data not available; no confirmed active exploitation or POC identified at time of analysis.

Technical ContextAI

WeKan is an open-source kanban board application built on Meteor framework with REST API integration capabilities. This vulnerability stems from CWE-862 (Missing Authorization) in the JsonRoutes REST API handlers that govern integration management functions. The affected endpoints fail to verify whether the authenticated user possesses administrative privileges before executing sensitive operations like webhook enumeration, integration creation/modification/deletion, and activity management. The CVSS 4.0 vector indicates network-accessible exploitation (AV:N) requiring only low-privilege authentication (PR:L) with no additional attack complexity (AC:L/AT:N). The high confidentiality impact (VC:H) reflects exposure of webhook URLs and potential secrets, while high integrity impact (VI:H) indicates unauthorized modification of integration configurations. CPE cpe:2.3:a:wekan:wekan identifies the affected product across all versions prior to the fix.

RemediationAI

Upgrade to WeKan version 8.35 or later, which implements proper authorization checks in Integration REST API endpoints per commit 2cd702f48df2b8aef0e7381685f8e089986a18a4 (https://github.com/wekan/wekan/commit/2cd702f48df2b8aef0e7381685f8e089986a18a4). Release available at https://github.com/wekan/wekan/releases/tag/v8.35. For environments unable to immediately upgrade, implement compensating controls: restrict board membership to trusted users only, audit integration configurations for unauthorized changes, rotate webhook URLs and secrets, monitor API access logs for suspicious integration-related requests from low-privilege accounts, and consider network-level restrictions to Integration API endpoints using reverse proxy rules (note this may impact legitimate integration functionality). Review and remove any unauthorized integrations created before patching. No workaround restores proper authorization without upgrading.