Junglewise Threat Intelligence

CVE-2026-52892: Wekan authorization bypass for custom fields in REST API

CVE-2026-52892 · Severity: medium · CVSS 6.5 · Published 2026-07-15

Technologies: WeKan. Vendors: WeKan.

Executive brief

Wekan is an open-source Kanban board application used for project management and task tracking. A security flaw allowed users with 'read-only' access to a board to bypass restrictions and modify, create, or delete custom fields and dropdown items via the application's programming interface (API). This could allow a restricted user to disrupt project organization or tamper with board data they should not be able to edit.

Technical details

A missing authorization check (CWE-862) exists in Wekan's REST API handlers within `server/models/customFields.js`. Specifically, six mutating handlers (POST, PUT, and DELETE) for custom fields and dropdown items utilized `Authentication.checkBoardAccess` (a read-level check) instead of `Authentication.checkBoardWriteAccess`. This allows an authenticated user with read-only board permissions to perform write operations via the API when `WITH_API=true` is enabled. The vulnerability is limited to intra-board integrity tampering and does not allow cross-board access. The issue was resolved in version 9.32 by updating the handlers to use the correct write-level authorization primitive.

Affected products

  • Wekan Wekan < 9.32

Timeline

  • 2026-05-30: advisory: GitHub Security Advisory GHSA-6733-4wgq-8xvr published
  • 2026-05-31: patched: Fixed in version 9.32
  • 2026-07-15: disclosed: NVD publication date

References

Related threats