CVE-2026-55234— Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)
Quick assessment
Affected
wekan wekan
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WeKan wekan是WeKan团队的协同项目管理平台。 Wekan 9.37之前版本存在安全漏洞，该漏洞源于DDP更新规则在server/permissions/cards.js、server/permissions/lists.js和server/permissions/swimlanes.js中针对存储的源boardId进行授权，未验证更新修饰符中的新boardId，导致任何具有自己board写权限的认证用户可以通过调用/cards/update、/lists/update或/swimlanes/
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55234
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)
Source: CVE Program / CVE List V5
Vulnerability Description
Wekan is open source kanban built with Meteor. Prior to 9.37, Wekan DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and server/permissions/swimlanes.js authorize against the stored source boardId and do not validate a new boardId in the update modifier. Any authenticated user with write access to their own board can call /cards/update, /lists/update, or /swimlanes/update to move cards, lists, or swimlanes into a private board they are not a member of. This issue is fixed in version 9.37.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Wekan 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WeKan wekan是WeKan团队的协同项目管理平台。 Wekan 9.37之前版本存在安全漏洞，该漏洞源于DDP更新规则在server/permissions/cards.js、server/permissions/lists.js和server/permissions/swimlanes.js中针对存储的源boardId进行授权，未验证更新修饰符中的新boardId，导致任何具有自己board写权限的认证用户可以通过调用/cards/update、/lists/update或/swimlanes/
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-55234
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 6020 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-55234
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55234 (1)
Vendor Advisories for CVE-2026-55234 (1)
Vendor Pages for CVE-2026-55234 (1)
Same Patch Batch · wekan · 2026-07-15 · 10 CVEs total
| CVE-2026-52891 | 9.9 CRITICAL | Wekan: Shell Injection via Avatar Upload |
| CVE-2026-55652 | 9.8 CRITICAL | Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unaut |
| CVE-2026-52890 | 7.1 HIGH | Wekan: Arbitrary file read and server DoS via attachment versions.original.path |
| CVE-2026-53447 | 6.5 MEDIUM | Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) a |
| CVE-2026-52892 | 6.5 MEDIUM | Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalatio |
| CVE-2026-53444 | Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin | |
| CVE-2026-53445 | Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards | |
| CVE-2026-53446 | Wekan: Server-Side Request Forgery (SSRF) via webhook integration URLs | |
| CVE-2026-52893 | Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser h |
IV. Related Vulnerabilities
Same product: wekan
-
CVE-2026-68901
WeKan Board Export REST Endpoints: NULL Pointer Dereference -
CVE-2026-68900
Wekan: Stored XSS in HTML board exports through a card-title -
CVE-2026-68899
Wekan: File Upload MIME Type Validation Bypass — Stored XSS -
CVE-2026-68561
Wekan: a low-privilege board member escalates to board admin -
CVE-2026-68560
Wekan:hell Injection in External Antivirus Scanner Path via
Same vendor: wekan
-
CVE-2026-68901
WeKan Board Export REST Endpoints: NULL Pointer Dereference -
CVE-2026-68900
Wekan: Stored XSS in HTML board exports through a card-title -
CVE-2026-68899
Wekan: File Upload MIME Type Validation Bypass — Stored XSS -
CVE-2026-68561
Wekan: a low-privilege board member escalates to board admin -
CVE-2026-68560
Wekan:hell Injection in External Antivirus Scanner Path via
Same weakness: CWE-284
-
CVE-2026-102795
Apache Traffic Server: SNI to Host header matching policy is -
CVE-2026-63045
Apache HTTP Server: mod_proxy_ftp PASV address handling -
CVE-2026-76142
Genians, Inc. Genian NAC/ZTNA Improper Access Control on the -
CVE-2026-103534
David-Crty databasement Snapshot Model snapshots SnapshotPol -
CVE-2026-102132
Kiteworks Core Privilege Escalation through Improper Access
V. Comments for CVE-2026-55234
No comments yet