CVE-2026-55234

Received Received - Intake

Wekan DDP Update Permission Bypass via Board ID Manipulation

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Wekan is open source kanban built with Meteor. Prior to 9.37, Wekan DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and server/permissions/swimlanes.js authorize against the stored source boardId and do not validate a new boardId in the update modifier. Any authenticated user with write access to their own board can call /cards/update, /lists/update, or /swimlanes/update to move cards, lists, or swimlanes into a private board they are not a member of. This issue is fixed in version 9.37.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-07-16

AI Q&A

2026-07-16

EPSS Evaluated

N/A

NVD

CVE-2026-55234

Affected Vendors & Products

Vendor	Product	Version / Range
wekan	wekan	to 9.37 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Wekan is an open-source kanban tool built with Meteor. A vulnerability exists in versions before 9.37 where the DDP update function does not validate the boardId in the update modifier. This allows authenticated users with write access to move cards, lists, or swimlanes into private boards they are not members of by exploiting the update endpoints.

Impact Analysis

An attacker with write access to a board could move sensitive cards, lists, or swimlanes into a private board they control. This could lead to unauthorized access to confidential data, data leakage, or disruption of workflows.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data. GDPR requires protecting personal data, and HIPAA requires safeguarding health information. Unauthorized board access may lead to data breaches and non-compliance penalties.

Mitigation Strategies

Upgrade Wekan to version 9.37 or later to address the unauthorized board access issue. Ensure all users with write access are authenticated and validate board membership before allowing updates to cards, lists, or swimlanes.

Hi! I’m here to help you understand CVE-2026-55234. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70