Executive brief
Wekan is an open-source Kanban board application used for project management and task tracking. A security flaw allowed users with 'read-only' access to a board to bypass restrictions and modify, create, or delete custom fields and dropdown items via the application's programming interface (API). This could allow a restricted user to disrupt project organization or tamper with board data they should not be able to edit.
Technical details
A missing authorization check (CWE-862) exists in Wekan's REST API handlers within `server/models/customFields.js`. Specifically, six mutating handlers (POST, PUT, and DELETE) for custom fields and dropdown items utilized `Authentication.checkBoardAccess` (a read-level check) instead of `Authentication.checkBoardWriteAccess`. This allows an authenticated user with read-only board permissions to perform write operations via the API when `WITH_API=true` is enabled. The vulnerability is limited to intra-board integrity tampering and does not allow cross-board access. The issue was resolved in version 9.32 by updating the handlers to use the correct write-level authorization primitive.
Affected products
- Wekan Wekan < 9.32
Timeline
- 2026-05-30: advisory: GitHub Security Advisory GHSA-6733-4wgq-8xvr published
- 2026-05-31: patched: Fixed in version 9.32
- 2026-07-15: disclosed: NVD publication date