CVE-2026-30845: Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-06 · updated 2026-06-17
Weakness: CWE-200

Description

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the board composite publication in Wekan publishes all integration data for a board without any field filtering, exposing sensitive fields including webhook URLs and authentication tokens to any subscriber. Since board publications are accessible to all board members regardless of their role (including read-only and comment-only users), and even to unauthenticated DDP clients for public boards, any user who can access a board can retrieve its webhook credentials. This token leak allows attackers to make unauthenticated requests to the exposed webhooks, potentially triggering unauthorized actions in connected external services. This issue has been fixed in version 8.34.

Affected products

WeKan: from 8.31 before 8.33 — fixed in 8.33

How to fix

Upgrade to a fixed version: WeKan 8.33. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-30845 or the next vulnerability affects your stack