CVE-2026-68561

Received Received - Intake

Privilege Escalation in Wekan via Board Sort Manipulation

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow({ update }) rule in server/permissions/boards.js called canUpdateBoardSort in server/lib/utils.js, which authorized any board member whenever fieldNames included sort. Because Meteor combines allow rules with OR semantics and applies the complete modifier, a comment-only or read-only member could send one Boards.update with $set values for sort, members, permission, and title, make themselves the sole board administrator, expose a private board, and evict the legitimate owner; the last-admin deny rule inspected only $pull and did not block a wholesale $set of members. Version 9.89 requires sort to be the only modified field and rejects $set member arrays that remove the last active administrator. This issue is fixed in version 9.89.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-68561

EUVD

EUVD-2026-62703

Affected Vendors & Products

Vendor	Product	Version / Range
wekan	wekan	9.89
wekan	wekan	to 9.85 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

CVE-2026-68561, also called SortBleed, is a flaw in Wekan versions before 9.89. It lets low-privilege board members (like comment-only or read-only users) escalate to admin and take over private boards. The issue occurs because Meteor's collection allow rules approve entire updates if any rule matches, even if other unauthorized changes are included. Attackers could send a single update with the sort field plus changes like granting themselves admin rights or making the board public.

Detection Guidance

Detecting this vulnerability requires checking Wekan versions prior to 9.89. Inspect server logs for suspicious Boards.update operations with $set modifiers containing multiple fields like sort, members, permission, or title. Look for unauthorized admin role assignments or board visibility changes.

Impact Analysis

If you use Wekan versions before 9.89, an attacker with basic board access could take over your boards. They could add themselves as admin, change board visibility to public, remove the real owner, or modify board settings. This could expose sensitive data or disrupt your workflow. The attack requires only being a board member, no further interaction.

Mitigation Strategies

Upgrade Wekan to version 9.89 or later immediately. Review board memberships and permissions for unauthorized admin assignments. Monitor for unusual Boards.update operations with multiple $set fields. Consider revoking access for suspicious users.

Hi! I’m here to help you understand CVE-2026-68561. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70