Authorization Bypass in Wekan Kanban Board by Wekan Team

CVE-2026-59154

What is CVE-2026-59154?

Wekan, an open-source kanban application built on Meteor, contains a vulnerability that allows low-privileged authenticated users to exploit cross-board authorization bypass in versions prior to 9.64. This weakness occurs because the direct Meteor collection allow rules for Checklists and ChecklistItems authorize updates solely against the current source 'doc.cardId' without verifying the destination 'cardId' or 'boardId'. Consequently, an attacker with write access to one board and knowledge of a private card ID can create checklist data on an accessible card and relocate it to a private board of which they are not a member. This vulnerability presents significant security concerns, as it undermines the intended access controls and data privacy within the Wekan system. The issue has been addressed in version 9.64.

References