Riskcovery

CVE-2026-55234

Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)

State
Published
Severity
8.5 High
Published
Jul 15, 2026
Updated
Jul 16, 2026
Reserved
Jun 16, 2026

Read the record on cve.org

Description

Wekan is open source kanban built with Meteor. Prior to 9.37, Wekan DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and server/permissions/swimlanes.js authorize against the stored source boardId and do not validate a new boardId in the update modifier. Any authenticated user with write access to their own board can call /cards/update, /lists/update, or /swimlanes/update to move cards, lists, or swimlanes into a private board they are not a member of. This issue is fixed in version 9.37.

Scores

CVSSScoreVectorSource
3.18.5 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:LGitHub_M

Weaknesses

  • CWE-284 Improper Access Control
  • CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

ProductVersions
wekanwekan
  • < 9.37Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.