What’s Vulnerable › Products
WeKan vulnerabilities
59 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 54 published in the last 12 months.
Check whether your WeKan version is affected
Latest WeKan vulnerabilities
- CVE-2026-68901 — WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service (CVSS 6.5)
- CVE-2026-68900 — Wekan: Stored XSS in HTML board exports through a card-title second parse (CVSS 7.6)
- CVE-2026-68899 — Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback (CVSS 8.7)
- CVE-2026-68561 — Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule (CVSS 8.8)
- CVE-2026-68560 — Wekan:hell Injection in External Antivirus Scanner Path via asyncExec (CVSS 7.7)
- CVE-2026-68559 — Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`) (CVSS 6.5)
- CVE-2026-68558 — Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446) (CVSS 8.5)
- CVE-2026-55652 — Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin) (CVSS 9.8)
- CVE-2026-55234 — Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule) (CVSS 8.5)
- CVE-2026-53447 — Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID (CVSS 6.5)
- CVE-2026-53446 — Wekan: Server-Side Request Forgery (SSRF) via webhook integration URLs (CVSS 6.2)
- CVE-2026-53445 — Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards (CVSS 7.1)
- CVE-2026-53444 — Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin (CVSS 7.6)
- CVE-2026-52893 — Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook (CVSS 9.2)
- CVE-2026-52892 — Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops) (CVSS 6.5)
- CVE-2026-52891 — Wekan: Shell Injection via Avatar Upload (CVSS 9.9)
- CVE-2026-52890 — Wekan: Arbitrary file read and server DoS via attachment versions.original.path (CVSS 7.1)
- CVE-2026-59154 — Wekan: Checklist direct DDP updates can write checklist data into private boards (CVSS 4.3)
- CVE-2026-41455 — WeKan < 8.35 SSRF via Webhook URL (CVSS 8.5)
- CVE-2026-41454 — WeKan < 8.35 Missing Authorization via Integration REST API (CVSS 8.3)
- CVE-2026-30847 — Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens (CVSS 6.5)
- CVE-2026-30846 — Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication (CVSS 7.5)
- CVE-2026-30845 — Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication (CVSS 8.2)
- CVE-2026-30844 — Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading (CVSS 8.1)
- CVE-2026-30843 — Wekan has Cross-Board IDOR in Custom Fields Update Endpoints (CVSS 6.5)