Wekan CVE-2026-68561

The attacker must hold any level of Wekan board membership on the target board - read-only viewer and comment-only roles are both sufficient; no elevated board privilege is required. The target instance must be running Wekan prior to version 9.89. Unauthenticated users with no board membership cannot exploit this flaw. The sort-reorder allow rule is enabled by default in all affected Wekan deployments to support drag-to-reorder on the All Boards and Public Boards pages - no non-default configuration is required to be vulnerable. Exploitation is limited to boards the attacker has been explicitly invited to; boards the attacker is not a member of are not reachable via this vector.

CVSS 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects real-world risk. AV:N and AC:L are confirmed - the attack requires only a standard WebSocket/DDP connection and no special preconditions. PR:L is correct and important: any board membership level, including the lowest-privilege read-only or comment-only role, is sufficient. The High impact across all three CIA dimensions is justified: private boards are exposed (C:H), board configuration and membership are rewritten (I:H), and the legitimate owner is evicted with no recovery path short of re-invitation (A:H). No EPSS data was provided in the input, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV at time of analysis, so active exploitation is not confirmed. However, the GHSA advisory and fix commit are fully public, and the attack is trivially reproducible from the description - no specialized knowledge is required beyond the ability to send a crafted DDP call. The recurrence of the same Meteor allow-rule class in prior Wekan CVE-2026-55234 (BoardBleed) suggests this pattern may be actively targeted. Real-world risk is elevated beyond the CVSS score might suggest in isolation because the minimal privilege threshold (any board invitation) dramatically widens the attacker pool.

An attacker invited to a Wekan board in any capacity - even as a read-only viewer - sends a single Meteor DDP Boards.update call with the modifier {$set: {sort: 99, members: [{userId: '<attacker_id>', isAdmin: true, isActive: true}], permission: 'public', title: 'hijacked'}} to the target board. The canUpdateBoardSort allow rule fires on the presence of sort in fieldNames, Meteor applies the full modifier without field scoping, and in one network round-trip the attacker becomes the sole board administrator, the private board is flipped to world-readable, the board is renamed, and the legitimate owner is evicted. No separate POC exploit tool is required; a standard WebSocket client or browser console with DDP access is sufficient.