CVE-2026-41454

WeKan < 8.35 Missing Authorization via Integration REST API

State: Published
Severity: 8.7 High
Published: Apr 22, 2026
Updated: Jul 14, 2026
Reserved: Apr 20, 2026

Description

WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification. Attackers can enumerate integrations including webhook URLs, create new integrations, modify or delete existing integrations, and manage integration activities by exploiting insufficient authorization checks in the JsonRoutes REST handlers.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N	VulnCheck
3.1	8.3 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L	VulnCheck

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
wekanwekan	before 8.35.0Affected 2cd702f48df2b8aef0e7381685f8e089986a18a4Not affected

References

https://github.com/wekan/wekan/releases/tag/v8.35release-notes
https://github.com/wekan/wekan/commit/2cd702f48df2b8aef0e7381685f8e089986a18a4patch
https://www.vulncheck.com/advisories/wekan-missing-authorization-via-integration-rest-apithird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.