EUVD-2026-42935Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
PR:L confirmed by requirement for authenticated write access to a board; C:N because attacker cannot read private content; I:L for unauthorized data injection into restricted boards only.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Wekan is open source kanban built with Meteor. Prior to 9.64, Wekan has a cross-board authorization bypass in the direct Meteor collection allow rules for Checklists and ChecklistItems because updates are authorized only against the current source doc.cardId and do not inspect the destination cardId or boardId in the update modifier, allowing a low-privileged authenticated user with write access to one board and knowledge of a target private card id to create checklist data on an accessible card and move it into a private board where they are not a member. This issue is fixed in version 9.64.
AnalysisAI
Cross-board authorization bypass in Wekan prior to version 9.64 allows a low-privileged authenticated user to inject checklist data into private boards where they hold no membership. The flaw resides in Meteor's collection allow rules for Checklists and ChecklistItems, which validate write access against the source card's context but ignore the destination cardId or boardId embedded in the update modifier - enabling an attacker with write access to any one board to redirect checklist mutations into boards they are not permitted to access. No active exploitation has been identified and no public exploit code exists; a vendor-confirmed fix is available in version 9.64.
Technical ContextAI
Wekan is an open-source kanban application built on the Meteor JavaScript framework. Meteor exposes a reactive data layer using client-side 'allow/deny' rules that govern direct mutations to server-side MongoDB collections over the DDP (Distributed Data Protocol) WebSocket connection. The vulnerability (CWE-863: Incorrect Authorization) manifests because the allow rules for the Checklist and ChecklistItem collections verify the requester's authorization by checking that the authenticated user has write access to the card identified by the source document's cardId field - but fail to re-validate authorization when the update modifier contains a different destination cardId or boardId. Because Meteor processes the $set modifier against the database after the allow check passes, an attacker can legally pass the source authorization gate while silently redirecting the write to an unauthorized target board. The affected CPE is cpe:2.3:a:wekan:wekan:*:*:*:*:*:*:*:*, covering all versions prior to 9.64.
RemediationAI
Upgrade Wekan to version 9.64 or later, which corrects the Meteor collection allow rules to validate both the source and destination cardId and boardId before permitting any checklist mutation. The specific fix commit is b1ca76007b9a295fd029dfefc1a2d1d6f1920835 (https://github.com/wekan/wekan/commit/b1ca76007b9a295fd029dfefc1a2d1d6f1920835). If immediate patching is not possible, the most effective compensating control is to restrict user accounts to only the boards they genuinely require access to, minimizing the attacker's ability to possess both a valid write-enabled board and knowledge of a foreign private card ID simultaneously. Additionally, auditing Meteor DDP traffic at the network layer for anomalous Checklist/ChecklistItem update operations referencing unexpected boardId values may surface exploitation attempts, though this requires custom monitoring logic. No fully equivalent workaround exists that eliminates the vulnerability without the code-level fix.
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by t
OS command injection in Wekan (the open-source Meteor-based kanban board) before version 9.07 lets an authenticated user
Authentication bypass in Wekan (open-source Meteor kanban) before version 9.46 lets an unauthenticated attacker imperson
A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticate
Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scrip
Account takeover in Wekan (open-source Meteor kanban) before 9.32 allows an attacker who controls an OIDC provider accou
Privilege escalation in Wekan open-source kanban (all versions prior to 9.89, dubbed 'SortBleed') allows any board membe
Stored XSS in Wekan prior to v9.90 allows authenticated board members to upload HTML containing JavaScript disguised as
LDAP filter injection in WeKan before 8.19 allows remote unauthenticated attackers to manipulate LDAP search filters and
Privilege escalation in WeKan (versions prior to 8.35) allows authenticated board members with low privileges to perform
Wekan's outgoing webhook URL validator in versions 8.36 through 9.73 allows authenticated board members to bypass SSRF p
Improper access control in Wekan (self-hosted open-source Meteor kanban) before version 9.37 lets any authenticated user
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today