CVE-2026-41455

Deferred Deferred - Pending Action

Server-Side Request Forgery in WeKan Webhook Integration Allows Unauthorized Data Manipulation

Publication date: 2026-04-22

Last updated on: 2026-07-14

Assigner: VulnCheck

Description

WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the URL scheme field accepts any string without protocol restriction or destination validation. Attackers who can create or modify integrations can set webhook URLs to internal network addresses, causing the server to issue HTTP POST requests to attacker-controlled internal targets with full board event payloads, and can additionally exploit response handling to overwrite arbitrary comment text without authorization checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-22

Last Modified

2026-07-14

Generated

2026-07-26

AI Q&A

2026-04-23

EPSS Evaluated

2026-07-25

NVD

CVE-2026-41455

EUVD

EUVD-2026-25118

Affected Vendors & Products

Vendor	Product	Version / Range
wekan	wekan	to 8.35 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Wekan versions before 8.35 and involves server-side request forgery (SSRF) in the webhook integration URL handling.

The URL schema field accepts any string without restricting the protocol or validating the destination.

Attackers who have the ability to create or modify integrations can set webhook URLs to internal network addresses.

This causes the server to send HTTP POST requests to internal targets controlled by the attacker, including full board event payloads.

Additionally, attackers can exploit response handling to overwrite arbitrary comment text without authorization checks.

Impact Analysis

This vulnerability can allow attackers to make the server send unauthorized HTTP POST requests to internal network addresses, potentially accessing or interacting with internal services that should be protected.

Attackers can also overwrite comment text arbitrarily without authorization, which could lead to misinformation, data integrity issues, or unauthorized content injection.

Hi! I’m here to help you understand CVE-2026-41455. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70