Which versions of Wekan are affected by CVE-2026-53444?

Wekan self-hosted kanban installations before version 9.32 contain a privilege escalation vulnerability allowing authenticated users to gain administrative access, enabling unauthorized control of…

How to fix or mitigate CVE-2026-53444?

Within 24 hours, identify all Wekan deployments and document current versions. Within 7 days, upgrade all instances to Wekan v9.32 or later and verify OIDC-related authentication settings if in use. Within 30 days, audit activity logs for any unauthorized organization or team creation/modification since deployment, and review user access privileges to ensure proper separation of duties.

Wekan CVE-2026-53444

Q: What is the CVSS score of CVE-2026-53444?

CVE-2026-53444 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

HIGH

Improper Privilege Management (CWE-269)

2026-07-15 GitHub_M

Privilege Escalation Wekan

7.6

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network-reachable Meteor method callable by any authenticated user (PR:L, AC:L); admin escalation grants high confidentiality/integrity impact with limited availability effect, no scope change within the same app authority.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 22:02 vuln.today

Analysis Generated

Jul 15, 2026 - 22:02 vuln.today

CVE Published

Jul 15, 2026 - 21:11 cve.org

HIGH 7.6

DescriptionCVE.org

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/oidc_server.js, server/models/org.js, and server/models/team.js are globally callable without the admin authorization checks used by their non-OIDC counterparts. Authenticated users can call setCreateOrgFromOidc, setOrgAllFieldsFromOidc, setCreateTeamFromOidc, setTeamAllFieldsFromOidc, boardRoutineOnLogin, or groupRoutineOnLogin to create or modify organizations and teams, and groupRoutineOnLogin can grant global admin privileges when PROPAGATE_OIDC_DATA is enabled. This issue is fixed in version 9.32.

AnalysisAI

Privilege escalation in Wekan (self-hosted Meteor kanban) before 9.32 lets any authenticated user directly invoke OIDC-only Meteor methods that lack the admin authorization checks applied to their non-OIDC counterparts. By calling setCreateOrgFromOidc, setOrgAllFieldsFromOidc, setCreateTeamFromOidc, setTeamAllFieldsFromOidc, boardRoutineOnLogin, or groupRoutineOnLogin over DDP, a low-privileged user can create or modify organizations and teams, and - when PROPAGATE_OIDC_DATA is enabled - groupRoutineOnLogin can grant that user global admin. No public exploit identified at time of analysis; the vendor fix (v9.32) is confirmed and the flaw carries a CVSS 4.0 base score of 7.6.

Technical ContextAI

Wekan is built on the Meteor framework, where server-side 'Meteor methods' are remotely callable by clients over DDP unless explicitly restricted. The OIDC integration (packages/wekan-oidc/oidc_server.js) plus the org and team models (server/models/org.js, server/models/team.js) define helper methods intended to run only during the server-side OIDC login flow via Meteor.callAsync, where they carry out privileged writes with no per-user authorization. Because these methods were registered globally without gating on the caller, they were exposed to ordinary authenticated clients - the root cause classed as CWE-269 (Improper Privilege Management). The fix distinguishes internal server-side invocation (this.connection === null) from a direct client/DDP call (this.connection non-null) and rejects the latter with a not-authorized error, restoring the admin-only restriction that setCreateOrg/setOrgAllFields/setCreateTeam/setTeamAllFields already enforced. CPE cpe:2.3:a:wekan:wekan:*:*:*:*:*:*:*:* identifies all Wekan versions prior to 9.32 as affected.

RemediationAI

Vendor-released patch: upgrade to Wekan 9.32 or later, which adds server-side connection checks (this.connection !== null → not-authorized) to the affected OIDC methods; this is the primary and complete fix per advisory GHSA-cv95-8h7c-2ffq (https://github.com/wekan/wekan/security/advisories/GHSA-cv95-8h7c-2ffq) and commit 305864f0c77456ad0f2c1e616266c8a06749c951. If you cannot upgrade immediately, disable the PROPAGATE_OIDC_DATA feature to remove the global-admin escalation path (trade-off: OIDC group/role data will no longer be propagated into Wekan, so org/team membership must be managed manually), which reduces the flaw to unauthorized org/team creation/modification rather than full admin takeover. As a further compensating control, restrict who can obtain authenticated Wekan accounts and audit existing organizations, teams, and admin assignments for unexpected changes before and after patching, since any prior exploitation would persist through an upgrade. Avoid exposing the Wekan instance to untrusted user registration until patched.