Regular Expression Vulnerability in Wekan Kanban Platform by Wekan

CVE-2026-119300

What is CVE-2026-119300?

Wekan, an open-source kanban board application, has been found to have a vulnerability that allows authenticated users to exploit user-controlled input in the search functionality. This is due to a flaw in the user-search publication and searchUsers method, which improperly processes the input for regular expression construction, leaving it susceptible to catastrophic backtracking. This situation leads to excessive CPU usage on database queries, potentially resulting in degraded performance or denial of service for other users on the platform. The issue has been resolved in version 11.11, ensuring that such vulnerabilities do not affect MongoDB-backed deployments using proper configurations.

References