Quick answers
- Is CVE-2026-52892 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-52892 being exploited in the wild.
- How severe is CVE-2026-52892?
- Medium severity, with a CVSS score of 6.5, published 15 July 2026.
- Which products and versions are affected?
- WeKan < 9.32.
- Is there a fix for CVE-2026-52892?
- A patch was published on 2026-05-31: Fixed in version 9.32 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-52892 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-52892?
- Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A missing authorization check (CWE-862) exists in Wekan's REST API handlers within `server/models/customFields.js`. Specifically, six mutating handlers (POST, PUT, and DELETE) for custom fields and dropdown items utilized `Authentication.checkBoardAccess` (a read-level check) instead of `Authentication.checkBoardWriteAccess`. This allows an authenticated user with read-only board permissions to perform write operations via the API when `WITH_API=true` is enabled. The vulnerability is limited to intra-board integrity tampering and does not allow cross-board access. The issue was resolved in version 9.32 by updating the handlers to use the correct write-level authorization primitive.
Affected products
- Wekan Wekan < 9.32
Timeline
- 2026-05-30: advisory: GitHub Security Advisory GHSA-6733-4wgq-8xvr published
- 2026-05-31: patched: Fixed in version 9.32
- 2026-07-15: disclosed: NVD publication date