# CVE-2026-52892: Wekan authorization bypass for custom fields in REST API

Source: https://junglewise.ai/threats/cve-2026-52892-wekan-authorization-bypass-for-custom-fields-in-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-52892 · Severity: medium · CVSS 6.5 · Published 2026-07-15

Wekan is an open-source Kanban board application used for project management and task tracking. A security flaw allowed users with 'read-only' access to a board to bypass restrictions and modify, create, or delete custom fields and dropdown items via the application's programming interface (API). This could allow a restricted user to disrupt project organization or tamper with board data they should not be able to edit.

Technologies: [WeKan](https://junglewise.ai/threats/technologies/wekan). Vendors: [WeKan](https://junglewise.ai/threats/vendors/wekan).

## Quick answers

**Is CVE-2026-52892 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52892 being exploited in the wild.

**How severe is CVE-2026-52892?** Medium severity, with a CVSS score of 6.5, published 15 July 2026.

**Which products and versions are affected?** WeKan < 9.32.

**Is there a fix for CVE-2026-52892?** A patch was published on 2026-05-31: Fixed in version 9.32 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52892 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-52892?** Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization check (CWE-862) exists in Wekan's REST API handlers within `server/models/customFields.js`. Specifically, six mutating handlers (POST, PUT, and DELETE) for custom fields and dropdown items utilized `Authentication.checkBoardAccess` (a read-level check) instead of `Authentication.checkBoardWriteAccess`. This allows an authenticated user with read-only board permissions to perform write operations via the API when `WITH_API=true` is enabled. The vulnerability is limited to intra-board integrity tampering and does not allow cross-board access. The issue was resolved in version 9.32 by updating the handlers to use the correct write-level authorization primitive.

## Affected products

- Wekan Wekan < 9.32

## Timeline

- 2026-05-30: advisory: GitHub Security Advisory GHSA-6733-4wgq-8xvr published
- 2026-05-31: patched: Fixed in version 9.32
- 2026-07-15: disclosed: NVD publication date

## References

- [https://github.com/wekan/wekan/commit/70db04a93fedabe40331f21f86e6bdc91625914e](https://github.com/wekan/wekan/commit/70db04a93fedabe40331f21f86e6bdc91625914e)
- [https://github.com/wekan/wekan/releases/tag/v9.32](https://github.com/wekan/wekan/releases/tag/v9.32)
- [https://github.com/wekan/wekan/security/advisories/GHSA-6733-4wgq-8xvr](https://github.com/wekan/wekan/security/advisories/GHSA-6733-4wgq-8xvr)

## Related threats

- [Wekan ReDoS in user search via unescaped regex](https://junglewise.ai/threats/cve-2026-119300-wekan-is-open-source-kanban-built-with-meteor-prior-to-11-11-the)
- [Wekan authentication bypass via X-Forwarded-For spoofing in header-login](https://junglewise.ai/threats/cve-2026-55652-wekan-authentication-bypass-via-x-forwarded-for-spoofing-in)
- [Wekan broken access control in DDP update rules](https://junglewise.ai/threats/cve-2026-55234-wekan-broken-access-control-in-ddp-update-rules)
- [Wekan missing authorization in cloneBoard method](https://junglewise.ai/threats/cve-2026-53447-wekan-missing-authorization-in-cloneboard-method)
- [Wekan SSRF in webhook integration URLs](https://junglewise.ai/threats/cve-2026-53446-wekan-ssrf-in-webhook-integration-urls)