Insecure Direct Object Reference Vulnerability in Wekan Kanban Tool

CVE-2026-30843

What is CVE-2026-30843?

Wekan, an open source kanban tool, is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability that allows unauthorized users to modify custom fields across different boards. This issue arises from the lack of proper validation in the custom fields update endpoints. While Wekan verifies access to a specified board ID, it fails to check if the custom field being modified actually belongs to that board during the database update process. As a result, an attacker with access to any board can alter custom fields on any other board by manipulating the custom field ID. This flaw also extends to both the POST, PUT, and DELETE operations for dropdown items linked to custom fields. The vulnerability can be exploited by obtaining necessary custom field IDs through board exports, which are accessible without any restricted permissions. The issue has been addressed in Wekan version 8.34.

References