Missing Authorization in WeKan Integration REST API for Authenticated Users

CVE-2026-41454

What is CVE-2026-41454?

In WeKan versions prior to 8.35, a significant missing authorization flaw exists within the Integration REST API endpoints. This vulnerability enables authenticated board members to execute administrative tasks without the necessary privilege verifications. By exploiting insufficient authorization checks present in the JsonRoutes REST handlers, an attacker can enumerate integrations, including accessing webhook URLs, and can create, modify, or delete integrations, as well as manage integration activities, posing a serious risk to the integrity of the application and its data.

References