Wekan
CVE-2026-53446
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Board administrator credentials required (PR:H), network API access sufficient (AV:N), scope changes to internal systems (S:C) with high confidentiality and low integrity impact on those systems.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan webhook integration URLs in models/integrations.js are stored from user input and later fetched by server/notifications/outgoing.js without applying the existing validateAttachmentUrl() private-network checks from models/lib/attachmentUrlValidation.js. A board administrator can configure webhook URLs that cause server-side requests to internal or metadata services. This issue is fixed in version 9.32.
AnalysisAI
Server-side request forgery in Wekan's webhook integration feature allows board administrators to register malicious webhook URLs that the Wekan server later fetches without private-network validation, enabling unauthorized access to internal services and cloud metadata endpoints. All Wekan deployments prior to version 9.32 are affected; the root cause is that the existing validateAttachmentUrl() guard present in models/lib/attachmentUrlValidation.js was never wired into the webhook creation and update API paths. No public exploit has been identified and this is not listed in CISA KEV, but cloud-hosted Wekan instances face meaningful credential theft risk via cloud metadata service access.
Technical ContextAI
Wekan is a self-hosted, open-source Kanban board application built on the Meteor framework for Node.js. The vulnerable subsystem is the outgoing webhook integration, where user-supplied URLs are persisted via the POST and PUT handlers in server/models/integrations.js and later fetched by the server-side notification dispatcher in server/notifications/outgoing.js. Wekan already possessed an SSRF guard - validateAttachmentUrl() in models/lib/attachmentUrlValidation.js - designed to block requests to loopback, RFC 1918 private ranges, and link-local addresses such as the AWS IMDS at 169.254.169.254. CWE-918 (Server-Side Request Forgery) precisely classifies the flaw: user-controlled URL input reaches a server-side HTTP fetch without the existing sanitization applied. The CPE cpe:2.3:a:wekan:wekan:*:*:*:*:*:*:*:* covers all prior releases. The fix commit 0e5fef6f31164fd3de4db353d04173ee0490cd65 imports validateAttachmentUrl into integrations.js and applies it as a pre-storage gate on both the create (POST) and update (PUT) paths.
RemediationAI
The primary remediation is to upgrade Wekan to version 9.32 or later; this release applies validateAttachmentUrl() validation to both the webhook creation and update API endpoints, blocking SSRF-capable URLs before they are stored. Fix details are available via the commit at https://github.com/wekan/wekan/commit/0e5fef6f31164fd3de4db353d04173ee0490cd65 and the release at https://github.com/wekan/wekan/releases/tag/v9.32. For deployments that cannot immediately upgrade, restrict the board administrator role to fully trusted internal users only, as this is the sole prerequisite for exploitation. In cloud environments, enforce IMDSv2 with a hop-limit of 1 on AWS (which prevents container-level SSRF from reaching the metadata service) and equivalent metadata server hardening on GCP and Azure. Apply host- or container-level egress firewall rules blocking outbound connections from the Wekan process to 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16; note this may break intentional webhook integrations targeting internal services, which should be re-evaluated against business need.
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by t
OS command injection in Wekan (the open-source Meteor-based kanban board) before version 9.07 lets an authenticated user
Authentication bypass in Wekan (open-source Meteor kanban) before version 9.46 lets an unauthenticated attacker imperson
A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticate
Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scrip
Account takeover in Wekan (open-source Meteor kanban) before 9.32 allows an attacker who controls an OIDC provider accou
Privilege escalation in Wekan open-source kanban (all versions prior to 9.89, dubbed 'SortBleed') allows any board membe
Stored XSS in Wekan prior to v9.90 allows authenticated board members to upload HTML containing JavaScript disguised as
LDAP filter injection in WeKan before 8.19 allows remote unauthenticated attackers to manipulate LDAP search filters and
Privilege escalation in WeKan (versions prior to 8.35) allows authenticated board members with low privileges to perform
Wekan's outgoing webhook URL validator in versions 8.36 through 9.73 allows authenticated board members to bypass SSRF p
Improper access control in Wekan (self-hosted open-source Meteor kanban) before version 9.37 lets any authenticated user
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today