CVE-2026-41455

WeKan < 8.35 SSRF via Webhook URL

State: Published
Severity: 6.3 Medium
Published: Apr 22, 2026
Updated: Jul 14, 2026
Reserved: Apr 20, 2026

Description

WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the URL scheme field accepts any string without protocol restriction or destination validation. Attackers who can create or modify integrations can set webhook URLs to internal network addresses, causing the server to issue HTTP POST requests to attacker-controlled internal targets with full board event payloads, and can additionally exploit response handling to overwrite arbitrary comment text without authorization checks.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N	VulnCheck
3.1	8.5 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N	VulnCheck

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
wekanwekan	before 8.35.0Affected 2cd702f48df2b8aef0e7381685f8e089986a18a4Not affected

References

https://github.com/wekan/wekan/releases/tag/v8.35release-notes
https://github.com/wekan/wekan/commit/2cd702f48df2b8aef0e7381685f8e089986a18a4patch
https://www.vulncheck.com/advisories/wekan-ssrf-via-webhook-urlthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.