https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-30847.htmlhttps://patchthecve.com/cve/CVE-2026-30847.htmlWed, 17 Jun 2026 10:33:01 +0000MEDIUM 6.5: Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the notificationUsers publication in Wekan publishes user documents with no field filtering, causing the ReactiveCache.getUsers() call to return all fields including highly sensitive data such as bcrypt password https://patchthecve.com/cve/CVE-2026-30846.htmlhttps://patchthecve.com/cve/CVE-2026-30846.htmlWed, 17 Jun 2026 10:33:01 +0000HIGH 7.5: Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the globalwebhooks publication exposes all global webhook integrations—including sensitive url and token fields—without performing any authentication check on the server side. Although the subscription is normallhttps://patchthecve.com/cve/CVE-2026-30845.htmlhttps://patchthecve.com/cve/CVE-2026-30845.htmlWed, 17 Jun 2026 10:33:01 +0000HIGH 8.2: Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the board composite publication in Wekan publishes all integration data for a board without any field filtering, exposing sensitive fields including webhook URLs and authentication tokens to any subscriber. Sincehttps://patchthecve.com/cve/CVE-2026-30844.htmlhttps://patchthecve.com/cve/CVE-2026-30844.htmlWed, 17 Jun 2026 10:33:01 +0000HIGH 8.1: Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 are vulnerable to Server-Side Request Forgery (SSRF) via attachment URL loading. During board import in Wekan, attachment URLs from user-supplied JSON data are fetched directly by the server without any URL validation or fhttps://patchthecve.com/cve/CVE-2026-30843.htmlhttps://patchthecve.com/cve/CVE-2026-30843.htmlWed, 17 Jun 2026 10:33:00 +0000MEDIUM 6.5: Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 have a critical Insecure Direct Object Reference (IDOR) issue which could allow unauthorized users to modify custom fields across boards through its custom fields update endpoints, potentially leading to unauthorized data https://patchthecve.com/cve/CVE-2026-2209.htmlhttps://patchthecve.com/cve/CVE-2026-2209.htmlWed, 17 Jun 2026 10:30:32 +0000MEDIUM 6.3: A vulnerability was detected in WeKan up to 8.18. The affected element is the function setCreateTranslation of the file client/components/settings/translationBody.js of the component Custom Translation Handler. The manipulation results in improper authorization. The attack can be launched remotely. https://patchthecve.com/cve/CVE-2026-2208.htmlhttps://patchthecve.com/cve/CVE-2026-2208.htmlWed, 17 Jun 2026 10:30:32 +0000MEDIUM 4.3: A security vulnerability has been detected in WeKan up to 8.20. Impacted is an unknown function of the file server/publications/rules.js of the component Rules Handler. The manipulation leads to missing authorization. The attack can be initiated remotely. Upgrading to version 8.21 is recommended to https://patchthecve.com/cve/CVE-2026-2207.htmlhttps://patchthecve.com/cve/CVE-2026-2207.htmlWed, 17 Jun 2026 10:30:32 +0000MEDIUM 5.3: A weakness has been identified in WeKan up to 8.20. This issue affects some unknown processing of the file server/publications/activities.js of the component Activity Publication Handler. Executing a manipulation can lead to information disclosure. It is possible to launch the attack remotely. Upgrahttps://patchthecve.com/cve/CVE-2026-2206.htmlhttps://patchthecve.com/cve/CVE-2026-2206.htmlWed, 17 Jun 2026 10:30:32 +0000MEDIUM 6.3: A security flaw has been discovered in WeKan up to 8.20. This vulnerability affects unknown code of the file server/methods/fixDuplicateLists.js of the component Administrative Repair Handler. Performing a manipulation results in improper access controls. It is possible to initiate the attack remotehttps://patchthecve.com/cve/CVE-2026-2205.htmlhttps://patchthecve.com/cve/CVE-2026-2205.htmlWed, 17 Jun 2026 10:30:32 +0000MEDIUM 4.3: A vulnerability was identified in WeKan up to 8.20. This affects an unknown part of the file server/publications/cards.js of the component Meteor Publication Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. Upgrading to version 8.21 is able to mitihttps://patchthecve.com/cve/CVE-2026-25859.htmlhttps://patchthecve.com/cve/CVE-2026-25859.htmlTue, 14 Jul 2026 16:16:55 +0000HIGH 8.8: Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in unauthorized migration operations.https://patchthecve.com/cve/CVE-2026-25568.htmlhttps://patchthecve.com/cve/CVE-2026-25568.htmlTue, 14 Jul 2026 16:16:55 +0000MEDIUM 4.3: WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforced at board creation time. When allowPrivateOnly is enabled, users can still create public boards due to incomplete server-side enforcement.https://patchthecve.com/cve/CVE-2026-25567.htmlhttps://patchthecve.com/cve/CVE-2026-25567.htmlTue, 14 Jul 2026 16:16:55 +0000MEDIUM 4.3: WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API. The endpoint accepts an authorId from the request body, allowing an authenticated user to spoof the recorded comment author by supplying another user's identifier.https://patchthecve.com/cve/CVE-2026-25566.htmlhttps://patchthecve.com/cve/CVE-2026-25566.htmlTue, 14 Jul 2026 16:16:54 +0000MEDIUM 5.4: WeKan versions prior to 8.19 contain an authorization vulnerability in card move logic. A user can specify a destination board/list/swimlane without adequate authorization checks for the destination and without validating that destination objects belong to the destination board, potentially enablinghttps://patchthecve.com/cve/CVE-2026-25565.htmlhttps://patchthecve.com/cve/CVE-2026-25565.htmlTue, 14 Jul 2026 16:16:54 +0000MEDIUM 6.5: WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring write permission. This can allow users with read-only roles to perform card updates that should require write access.https://patchthecve.com/cve/CVE-2026-25564.htmlhttps://patchthecve.com/cve/CVE-2026-25564.htmlTue, 14 Jul 2026 16:16:54 +0000HIGH 7.5: WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not verify that the supplied cardId belongs to the supplied boardId, allowing cross-board ID tampering by manipulating identifiers.https://patchthecve.com/cve/CVE-2026-25563.htmlhttps://patchthecve.com/cve/CVE-2026-25563.htmlTue, 14 Jul 2026 16:16:54 +0000HIGH 7.5: WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not verify that the supplied cardId belongs to the supplied boardId, allowing cross-board ID tampering by manipulating identifiers.https://patchthecve.com/cve/CVE-2026-25562.htmlhttps://patchthecve.com/cve/CVE-2026-25562.htmlTue, 14 Jul 2026 16:16:54 +0000MEDIUM 4.3: WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication. Attachment metadata can be returned without properly scoping results to boards and cards accessible to the requesting user, potentially exposing attachment metadata to unauthorized users.https://patchthecve.com/cve/CVE-2026-25561.htmlhttps://patchthecve.com/cve/CVE-2026-25561.htmlTue, 14 Jul 2026 16:16:54 +0000HIGH 7.5: WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API. The API does not fully validate that provided identifiers (such as boardId, cardId, swimlaneId, and listId) are consistent and refer to a coherent card/board relationship, enabling attempts to upload attachmhttps://patchthecve.com/cve/CVE-2026-25560.htmlhttps://patchthecve.com/cve/CVE-2026-25560.htmlTue, 14 Jul 2026 16:16:54 +0000CRITICAL 9.8: WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporated into LDAP search filters and DN-related values without adequate escaping, allowing an attacker to manipulate LDAP queries during authentication.https://patchthecve.com/cve/CVE-2026-1964.htmlhttps://patchthecve.com/cve/CVE-2026-1964.htmlWed, 17 Jun 2026 10:16:47 +0000MEDIUM 4.3: A vulnerability was determined in WeKan up to 8.20. This impacts an unknown function of the file models/boards.js of the component REST Endpoint. This manipulation causes improper access controls. Remote exploitation of the attack is possible. Upgrading to version 8.21 will fix this issue. Patch namhttps://patchthecve.com/cve/CVE-2026-1963.htmlhttps://patchthecve.com/cve/CVE-2026-1963.htmlWed, 17 Jun 2026 10:16:47 +0000MEDIUM 6.3: A vulnerability was found in WeKan up to 8.20. This affects an unknown function of the file models/attachments.js of the component Attachment Storage. The manipulation results in improper access controls. The attack may be launched remotely. Upgrading to version 8.21 mitigates this issue. The patch https://patchthecve.com/cve/CVE-2026-1962.htmlhttps://patchthecve.com/cve/CVE-2026-1962.htmlWed, 17 Jun 2026 10:16:47 +0000MEDIUM 6.3: A vulnerability has been found in WeKan up to 8.20. The impacted element is an unknown function of the file server/attachmentMigration.js of the component Attachment Migration. The manipulation leads to improper access controls. The attack may be initiated remotely. Upgrading to version 8.21 is suffhttps://patchthecve.com/cve/CVE-2026-1898.htmlhttps://patchthecve.com/cve/CVE-2026-1898.htmlWed, 17 Jun 2026 10:16:41 +0000MEDIUM 6.3: A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User Sync. This manipulation causes improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able tohttps://patchthecve.com/cve/CVE-2026-1897.htmlhttps://patchthecve.com/cve/CVE-2026-1897.htmlWed, 17 Jun 2026 10:16:41 +0000MEDIUM 4.3: A vulnerability was found in WeKan up to 8.20. Affected by this issue is some unknown functionality of the file server/methods/positionHistory.js of the component Position-History Tracking. The manipulation results in missing authorization. The attack may be performed from remote. Upgrading to versihttps://patchthecve.com/cve/CVE-2026-1896.htmlhttps://patchthecve.com/cve/CVE-2026-1896.htmlWed, 17 Jun 2026 10:16:40 +0000MEDIUM 6.3: A vulnerability has been found in WeKan up to 8.20. Affected by this vulnerability is the function ComprehensiveBoardMigration of the file server/migrations/comprehensiveBoardMigration.js of the component Migration Operation Handler. The manipulation of the argument boardId leads to improper access https://patchthecve.com/cve/CVE-2026-1895.htmlhttps://patchthecve.com/cve/CVE-2026-1895.htmlWed, 17 Jun 2026 10:16:40 +0000MEDIUM 6.3: A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment Storage Handler. Executing a manipulation can lead to improper access controls. The attack can be executed remotely. Upgrading to version 8.21 is able to address https://patchthecve.com/cve/CVE-2026-1894.htmlhttps://patchthecve.com/cve/CVE-2026-1894.htmlWed, 17 Jun 2026 10:16:40 +0000MEDIUM 6.3: A vulnerability was detected in WeKan up to 8.20. This impacts an unknown function of the file models/checklistItems.js of the component REST API. Performing a manipulation of the argument item.cardId/item.checklistId/card.boardId results in improper authorization. Remote exploitation of the attack https://patchthecve.com/cve/CVE-2026-1892.htmlhttps://patchthecve.com/cve/CVE-2026-1892.htmlWed, 17 Jun 2026 10:16:40 +0000MEDIUM 5.0: A security vulnerability has been detected in WeKan up to 8.20. This affects the function setBoardOrgs of the file models/boards.js of the component REST API. Such manipulation of the argument item.cardId/item.checklistId/card.boardId leads to improper authorization. The attack may be launched remothttps://patchthecve.com/cve/CVE-2025-65782.htmlhttps://patchthecve.com/cve/CVE-2025-65782.htmlWed, 14 Oct 2026 13:10:00 +0000MEDIUM 6.5: An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authorization flaw in card update handling allows board members (and potentially other authenticated users) to add/remove arbitrary user IDs in vote.positive / vote.negative arrays, enabling vothttps://patchthecve.com/cve/CVE-2025-65781.htmlhttps://patchthecve.com/cve/CVE-2025-65781.htmlWed, 14 Oct 2026 13:10:00 +0000HIGH 8.2: An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer value as a userId and enters a non-terminating body-handling branch for any non-empty bearer token, enabling trivial application-layer DoS ahttps://patchthecve.com/cve/CVE-2025-65780.htmlhttps://patchthecve.com/cve/CVE-2025-65780.htmlWed, 14 Oct 2026 13:10:00 +0000HIGH 8.8: An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to missing server-side authorization checks; this enables privilegehttps://patchthecve.com/cve/CVE-2025-65779.htmlhttps://patchthecve.com/cve/CVE-2025-65779.htmlWed, 14 Oct 2026 13:10:00 +0000HIGH 7.5: An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Unauthenticated attackers can update a board's "sort" value (Boards.allow returns true without verifying userId), allowing arbitrary reordering of boards.https://patchthecve.com/cve/CVE-2025-65778.htmlhttps://patchthecve.com/cve/CVE-2025-65778.htmlWed, 14 Oct 2026 13:10:00 +0000HIGH 8.1: An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be served with attacker-controlled Content-Type (text/html), allowing execution of attacker-supplied HTML/JS in the application's origin and enabling session/token theft