# CVE-2026-41454: WeKan missing authorization in Integration REST API

Source: https://junglewise.ai/threats/cve-2026-41454-wekan-missing-authorization-in-integration-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-41454 · Severity: high · CVSS 8.3 · Published 2026-04-22

WeKan, an open-source kanban board application, contains a security flaw in its integration management system. This vulnerability allows regular board members to perform administrative tasks they should not have access to, such as viewing, creating, or deleting webhooks and other third-party integrations. An attacker could use this to intercept sensitive data sent to external services or disrupt automated workflows.

Technologies: [WeKan](https://junglewise.ai/threats/technologies/wekan). Vendors: [WeKan](https://junglewise.ai/threats/vendors/wekan).

## Quick answers

**Is CVE-2026-41454 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41454 being exploited in the wild.

**How severe is CVE-2026-41454?** High severity, with a CVSS score of 8.3, published 22 April 2026.

**Which products and versions are affected?** WeKan < 8.35.

**Is there a fix for CVE-2026-41454?** A patch was published on 2026-03-05: Fix committed and version 8.35 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41454 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41454?** Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) exists in the Integration REST API endpoints of WeKan. The flaw is located within the JsonRoutes REST handlers, which fail to properly verify the privilege level of authenticated users before allowing access to integration management functions. An attacker with standard board member permissions can exploit this to enumerate existing integrations (including webhook URLs), create new ones, or modify/delete existing configurations. The vendor has addressed this in version 8.35, which also includes protections against related Server-Side Request Forgery (SSRF) risks in integration URLs.

## Affected products

- WeKan WeKan < 8.35

## Timeline

- 2026-03-05: patched: Fix committed and version 8.35 released.
- 2026-04-22: disclosed: Initial advisory published.

## References

- [https://github.com/wekan/wekan/commit/2cd702f48df2b8aef0e7381685f8e089986a18a4](https://github.com/wekan/wekan/commit/2cd702f48df2b8aef0e7381685f8e089986a18a4)
- [https://github.com/wekan/wekan/releases/tag/v8.35](https://github.com/wekan/wekan/releases/tag/v8.35)
- [https://www.vulncheck.com/advisories/wekan-missing-authorization-via-integration-rest-api](https://www.vulncheck.com/advisories/wekan-missing-authorization-via-integration-rest-api)

## Related threats

- [Wekan ReDoS in user search via unescaped regex](https://junglewise.ai/threats/cve-2026-119300-wekan-is-open-source-kanban-built-with-meteor-prior-to-11-11-the)
- [Wekan authentication bypass via X-Forwarded-For spoofing in header-login](https://junglewise.ai/threats/cve-2026-55652-wekan-authentication-bypass-via-x-forwarded-for-spoofing-in)
- [Wekan broken access control in DDP update rules](https://junglewise.ai/threats/cve-2026-55234-wekan-broken-access-control-in-ddp-update-rules)
- [Wekan missing authorization in cloneBoard method](https://junglewise.ai/threats/cve-2026-53447-wekan-missing-authorization-in-cloneboard-method)
- [Wekan SSRF in webhook integration URLs](https://junglewise.ai/threats/cve-2026-53446-wekan-ssrf-in-webhook-integration-urls)