Is CVE-2026-59154 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59154 being exploited in the wild.

How severe is CVE-2026-59154?

Medium severity, with a CVSS score of 4.3, published 10 July 2026.

Is there a fix for CVE-2026-59154?

A patch was published on 2026-06-20: Fix committed and version 9.64 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59154 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-59154?

Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59154: Wekan authorization bypass in Checklists and ChecklistItems

CVE-2026-59154 · Severity: medium · CVSS 4.3 · Published 2026-07-10

Wekan is an open-source project management tool used to organize tasks on digital boards. A security flaw allows a user who has access to at least one board to move task checklists into other private boards where they are not a member. This could allow an unauthorized person to inject data or manipulate the contents of private project boards if they know the ID of a card on that board.

Technologies: WeKan. Vendors: WeKan.

Quick answers

Is CVE-2026-59154 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59154 being exploited in the wild.
How severe is CVE-2026-59154?: Medium severity, with a CVSS score of 4.3, published 10 July 2026.
Which products and versions are affected?: WeKan < 9.64.
Is there a fix for CVE-2026-59154?: A patch was published on 2026-06-20: Fix committed and version 9.64 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59154 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-59154?: Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Wekan prior to version 9.64 is vulnerable to an authorization bypass (CWE-863) within the Meteor DDP collection 'allow' rules for Checklists and ChecklistItems. The vulnerability exists because the server-side validation only checks if the user has write access to the source card's board, but fails to inspect the update modifier for a new destination cardId or boardId. By directly interacting with the DDP collection and bypassing the 'moveChecklist' Meteor method, an authenticated attacker with write access to any board can move their own checklist items to a private board, provided they know the target card's ID. Once moved, the 'before.update' hook automatically re-assigns the checklist's boardId to match the destination card, effectively injecting the attacker's data into the victim's private board. This has been patched in version 9.64 by implementing destination-aware 'deny' rules.

Affected products

Wekan Wekan < 9.64

Timeline

2026-06-20: patched: Fix committed and version 9.64 released
2026-07-10: disclosed: CVE-2026-59154 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.