Authorization Flaw in Wekan Kanban by Wekan

CVE-2026-68561

What is CVE-2026-68561?

Wekan, the open-source kanban tool built on Meteor, has a significant security vulnerability in versions prior to 9.89. An improper authorization check in the Boards.allow() method empowers any board member to exploit the sort field, allowing them to manipulate board member roles and permissions. Specifically, a user with minimal access could execute an update that not only modifies sorting but also includes $set commands that change members and permissions, thereby granting themselves sole administrator privileges. This exploit risks exposing private boards and unlawfully evicting legitimate owners. The issue has been rectified in version 9.89, which enforces stricter rules on the modification of board fields.

References