Is CVE-2026-52893 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52893 being exploited in the wild.

How severe is CVE-2026-52893?

Informational severity, with a CVSS score of 9.2, published 15 July 2026.

Is there a fix for CVE-2026-52893?

A patch was published on 2026-05-31: Fixed in version 9.32 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-52893 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-52893?

Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52893: Wekan account takeover via OIDC account merging

CVE-2026-52893 · Severity: info · CVSS 9.2 · Published 2026-07-15

Wekan, an open-source Kanban board application, is vulnerable to account takeover when configured to use OpenID Connect (OIDC) for logins. An attacker can gain full control of a victim's account by logging in through an OIDC provider with a matching email address or username. This allows the attacker to access all of the victim's private boards, cards, and attachments, and potentially gain administrative privileges without the victim's knowledge or interaction.

Technologies: WeKan. Vendors: WeKan.

Quick answers

Is CVE-2026-52893 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52893 being exploited in the wild.
How severe is CVE-2026-52893?: Informational severity, with a CVSS score of 9.2, published 15 July 2026.
Which products and versions are affected?: WeKan < 9.32.
Is there a fix for CVE-2026-52893?: A patch was published on 2026-05-31: Fixed in version 9.32 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52893 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-52893?: Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Wekan 'Accounts.onCreateUser' hook within 'server/models/users.js'. When a user logs in via OIDC, the application searches for existing accounts with a matching email or username and unconditionally merges the new OIDC credentials into the existing record. The application fails to verify the 'email_verified' claim from the OIDC provider or perform any ownership challenge. An attacker can use a self-hosted or misconfigured OIDC provider to present a victim's email or username, causing Wekan to overwrite the victim's account data and grant the attacker access. This issue is resolved in version 9.32 by disabling automatic merging by default and requiring 'email_verified' claims when merging is enabled.

Affected products

Wekan Wekan < 9.32

Timeline

2026-05-30: advisory: GHSA-mp7g-hj5q-gxhq published by maintainers
2026-05-31: patched: Fixed in version 9.32
2026-07-15: disclosed: CVE-2026-52893 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.