Wekan
CVE-2026-52892
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-accessible REST API requires only authenticated board read membership (PR:L); high integrity impact from unrestricted field mutation; no confidentiality or availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAccess instead of write-level Authentication.checkBoardWriteAccess for mutating custom-field routes. A read-only board member can call POST, PUT, and DELETE handlers for /api/boards/:boardId/custom-fields and custom-field dropdown items to create, update, or delete board custom fields. This issue is fixed in version 9.32.
AnalysisAI
Incorrect authorization in Wekan's REST API (all versions prior to 9.32) permits any read-only board member to invoke write-level operations - creating, modifying, or deleting custom fields and dropdown items - on boards they should only be able to view. Six route handlers in server/models/customFields.js apply the read-level checkBoardAccess guard to mutating HTTP methods (POST, PUT, DELETE), instead of the write-level checkBoardWriteAccess. No public exploit or CISA KEV listing has been identified at time of analysis, but the logic flaw is straightforward to exploit by any authenticated board member with API access.
Technical ContextAI
Wekan is an open-source Kanban board application built on the Meteor JavaScript framework. The vulnerable code resides in server/models/customFields.js, which registers REST API route handlers via WebApp.handlers for the /api/boards/:boardId/custom-fields endpoint family. The root cause is CWE-862 (Missing Authorization): six distinct mutating route handlers - POST to create custom fields, two PUT handlers to update custom fields and dropdown items, and two DELETE handlers - each invoke Authentication.checkBoardAccess (the read-level guard) rather than Authentication.checkBoardWriteAccess. The commit diff (70db04a) confirms all six substitutions. This misconfiguration means that board-read membership, which is intended to grant only view access, is sufficient to satisfy the authorization gate on write operations. CPE cpe:2.3:a:wekan:wekan:*:*:*:*:*:*:*:* covers all Wekan versions up to but not including 9.32.
RemediationAI
Upgrade Wekan to version 9.32 or later, which replaces all six incorrect checkBoardAccess calls with checkBoardWriteAccess in server/models/customFields.js. The patched release is available at https://github.com/wekan/wekan/releases/tag/v9.32 and the specific fix commit is https://github.com/wekan/wekan/commit/70db04a93fedabe40331f21f86e6bdc91625914e. If immediate upgrade is not feasible, restrict board memberships to trusted users only - remove or downgrade any read-only members who should not be permitted indirect write capabilities, since all board members can exploit this flaw regardless of role assignment. As a network-level compensating control, blocking external access to /api/boards/*/custom-fields endpoints (for example, via reverse proxy ACL rules) will prevent exploitation from outside the trusted network perimeter, but will also break any API integrations relying on those endpoints. Review board audit logs for unexpected custom field creation or deletion activity in the window prior to patching.
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by t
OS command injection in Wekan (the open-source Meteor-based kanban board) before version 9.07 lets an authenticated user
Authentication bypass in Wekan (open-source Meteor kanban) before version 9.46 lets an unauthenticated attacker imperson
A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticate
Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scrip
Account takeover in Wekan (open-source Meteor kanban) before 9.32 allows an attacker who controls an OIDC provider accou
Privilege escalation in Wekan open-source kanban (all versions prior to 9.89, dubbed 'SortBleed') allows any board membe
Stored XSS in Wekan prior to v9.90 allows authenticated board members to upload HTML containing JavaScript disguised as
LDAP filter injection in WeKan before 8.19 allows remote unauthenticated attackers to manipulate LDAP search filters and
Privilege escalation in WeKan (versions prior to 8.35) allows authenticated board members with low privileges to perform
Improper access control in Wekan (self-hosted open-source Meteor kanban) before version 9.37 lets any authenticated user
Wekan's outgoing webhook URL validator in versions 8.36 through 9.73 allows authenticated board members to bypass SSRF p
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today