Wekan CVE-2026-53444

The attacker must have a valid authenticated Wekan account (PR:L) on an instance older than 9.32 that uses the OIDC/OAuth login integration, and must be able to issue direct Meteor DDP method calls (any standard Wekan client connection). Unauthorized organization and team creation/modification via setCreateOrgFromOidc, setOrgAllFieldsFromOidc, setCreateTeamFromOidc, setTeamAllFieldsFromOidc, or boardRoutineOnLogin works for any such authenticated user. Escalation to GLOBAL ADMIN specifically requires the PROPAGATE_OIDC_DATA environment/configuration flag to be ENABLED (the AT:P attack requirement) and is triggered through groupRoutineOnLogin. Limiting factors: exploitation is not possible for fully unauthenticated/anonymous attackers, non-OIDC deployments are not exposed to the OIDC helper methods, and full admin takeover is gated on the non-default PROPAGATE_OIDC_DATA setting - instances with it disabled face only org/team tampering, not privilege escalation to admin.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L) rates this 7.6 (High): network-reachable, low complexity, but requiring an existing low-privileged authenticated account (PR:L) and a present attack requirement (AT:P) - the latter reflecting that full global-admin takeover depends on the non-default PROPAGATE_OIDC_DATA setting being enabled. Even without that setting, unauthorized creation and modification of organizations and teams is available to any logged-in user, so integrity impact is real regardless of configuration. There is no CISA KEV listing and no EPSS score supplied, and no public exploit code is identified, so exploitation should be treated as plausible-but-unproven rather than active. The realistic priority is elevated for OIDC-enabled Wekan deployments - particularly any with PROPAGATE_OIDC_DATA on, where the impact is full admin compromise - and moderate elsewhere; the main mitigating factor is that an attacker must already hold a valid account, which limits fully anonymous exploitation. Note the vulnerability requires authentication (PR:L), so this is not a pre-auth remote issue despite the network attack vector.

An attacker who holds any low-privileged Wekan account on an OIDC-enabled, PROPAGATE_OIDC_DATA instance opens a DDP connection and directly calls the groupRoutineOnLogin method with crafted group data, causing the server to grant their own account global admin. With admin rights they can then read every board, alter organizations and teams, and control the deployment. No public exploit code has been identified, but the low attack complexity and simple method invocation make weaponization straightforward for anyone familiar with Meteor DDP.