Improper Access Control in Wekan Kanban by Wekan

CVE-2026-52892

What is CVE-2026-52892?

Wekan, the open-source kanban application built on Meteor, contains an improper access control vulnerability in its REST handlers. Prior to version 9.32, the application incorrectly used read-level access controls in the server/models/customFields.js file for mutating custom-field routes. This flaw allows users with read-only access to perform POST, PUT, and DELETE requests on the API endpoints related to custom fields, permitting them to create, update, or delete board custom fields without sufficient permissions. This issue was addressed and rectified in version 9.32, enhancing the security robustness of Wekan.

References