Wekan CVE-2026-53446

Exploitation requires the attacker to hold valid Wekan board administrator credentials (CVSS PR:H confirmed). The webhook integration feature must be available on the board, which is default behavior in Wekan - no non-default configuration flag is required beyond the attacker having admin rights. Exploitation is triggered when a board activity causes Wekan's outgoing notification dispatcher to fire and fetch the stored webhook URL server-side; the attacker can force this by performing any board action (card creation, movement) after setting the webhook. Limiting factors: general board members and unauthenticated users cannot configure webhooks; the SSRF reach depends on the network environment of the Wekan server host (internal services and metadata endpoints reachable only if the host itself has network access to them); and cloud environments with IMDSv2 enforcement or egress filtering will reduce or eliminate the most impactful exploitation paths.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N, score 6.2) accurately captures the risk profile: PR:H constrains exploitation to board administrators, a meaningful barrier that prevents this from being a general-user or anonymous threat. The SC:H (high confidentiality impact on subsequent systems) is the operative risk signal - a board administrator who is malicious or whose credentials are compromised can pivot the Wekan server into an internal network reconnaissance tool, and in cloud environments can read instance metadata credentials that confer broader cloud-account access. No EPSS score was provided in the source data. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, consistent with a lower-urgency finding. Real-world priority is elevated for cloud-hosted deployments (AWS, GCP, Azure) where cloud metadata service access is the primary escalation path, and for multi-tenant Wekan instances where board administrator role is granted to parties who should not be fully trusted with server-side network access.

A malicious board administrator submits a webhook integration URL pointing to http://169.254.169.254/latest/meta-data/iam/security-credentials/ via the Wekan API. When a card is moved or updated, Wekan's outgoing notification handler fetches the stored URL server-side, causing the cloud host's metadata service to return temporary IAM role credentials. Depending on how the Wekan server handles the HTTP response and any error logging, the attacker retrieves these credentials to escalate to cloud-account-level access. No public exploit code is required - exploitation uses standard Wekan API calls available to any board administrator.