WeKan CVE-2026-41455

The attacker must possess authenticated user account credentials for WeKan with sufficient privileges to create or modify integration configurations. This is confirmed by the CVSS vector's PR:L (low privilege requirement). Additionally, the webhook integration feature must be enabled in the WeKan deployment (a default configuration in most installations). Exploitation does NOT require the attacker to have high-level administrative privileges; typical board member or board admin roles are sufficient if those roles permit integration management. No special network conditions are required beyond the attacker's ability to authenticate to the WeKan application itself. The vulnerability is NOT exploitable by unauthenticated attackers or through default public-facing instances without valid credentials. Organizations that have disabled webhook integrations entirely or restricted integration creation to site administrators only will have reduced exposure, though the risk is not eliminated if those administrators can be socially engineered or if accounts are compromised.

This vulnerability presents moderate but contextual risk. The CVSS 6.3 score reflects low privileges required (PR:L) and network attack vector, but limited direct confidentiality and integrity impact on the WeKan system itself (VI:L, VC:N). However, real-world risk is elevated by several factors: (1) the SSRF component can pivot to internal infrastructure not directly protected by network segmentation, potentially compromising databases, internal APIs, or cloud metadata endpoints; (2) authenticated access is required, limiting exposure to insider threats or compromised accounts; (3) the response handling flaw enabling comment modification (SI:L) compounds the integrity risk. EPSS score not provided, but exploitation probability is moderate given that user creation/modification of integrations is a common administrative function. The attack complexity is low (AC:L), and no user interaction is required once the malicious webhook URL is configured. For organizations with strict internal network segmentation and limited integration management permissions, risk is lower. For organizations with permissive admin roles or federation scenarios, risk is elevated. The CVSS 4.0 vector marking attributes as unknown (X values for modifier fields) suggests incomplete scoring data; verify with vendor whether the scope changes across authorization boundaries.

An authenticated WeKan user with integration management privileges creates a webhook integration, intentionally configuring the URL to point to an internal database server (e.g., http://internal-postgres:5432) or cloud metadata endpoint (http://169.254.169.254/latest/meta-data/). When a board event occurs (card creation, update, comment), WeKan sends an HTTP POST request with the event payload to the malicious URL. The attacker either directly receives the payload on attacker infrastructure or uses the SSRF to probe internal services, extract metadata, or trigger unintended backend processes. The secondary comment modification flaw could then allow the attacker to alter board records without authorization, covering tracks or causing data integrity issues.