Wekan CVE-2026-52892

The attacker must possess a valid Wekan user account with at least read-only membership on the target board - write board membership is explicitly not required and is the core of this flaw. The Wekan REST API must be network-accessible to the attacker, which is the default for any publicly or internally hosted Wekan instance with API access enabled. The vulnerable endpoints are POST /api/boards/:boardId/custom-fields, PUT /api/boards/:boardId/custom-fields/:customFieldId, two PUT and DELETE routes for dropdown items, and DELETE /api/boards/:boardId/custom-fields/:customFieldId. Exploitation is bounded by the PR:L requirement confirmed by the CVSS vector: unauthenticated users and users with no board membership cannot exploit this vulnerability. No non-default configuration is required to be vulnerable - any Wekan deployment prior to v9.32 with at least one board having a read-only member is in scope.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N scores 6.5, accurately reflecting a network-accessible, low-complexity flaw requiring low-privilege authentication. The High integrity rating is consistent with an attacker's ability to alter or destroy all custom field definitions on a board without restriction. There is no confidentiality impact (read-only data is already accessible to board members) and no availability impact beyond data integrity loss. EPSS data was not provided in the input and cannot be independently assessed here. No CISA KEV listing exists and no public POC has been identified, placing this in the 'unconfirmed exploitation' category. The attack complexity is practically lower than CVSS AC:L suggests for opportunistic exploitation - the logic error is trivially exploitable by any board member with basic HTTP knowledge. However, the PR:L requirement (active board membership) materially limits the blast radius to insiders, external collaborators, or users with compromised Wekan accounts. Organizations sharing Wekan boards with untrusted read-only members, such as contractors or clients, face the most meaningful risk.

A contractor with read-only access to a Wekan project board uses their valid session token to issue a DELETE request to /api/boards/:boardId/custom-fields/:customFieldId, targeting all custom fields used for sprint tracking. The authorization check passes because it only validates board read membership, wiping the custom field schema and breaking existing card data linked to those fields for all board members. No special tooling beyond a standard HTTP client is required.