PT-2026-23745 · Wekan+1 · Wekan

Xet7 · Publicado 2026-03-06 · Atualizado 2026-03-11 · CVE-2026-30845

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wekan versions 8.31.0 through 8.33

Description Wekan is an open source kanban tool. In affected versions, the board composite publication publishes all integration data for a board without field filtering, exposing sensitive information like webhook URLs and authentication tokens to any subscriber. Board publications are accessible to all board members, regardless of their role, and even to unauthenticated DDP clients for public boards. This allows any user with board access to retrieve webhook credentials. This token leak enables attackers to make unauthenticated requests to exposed webhooks, potentially triggering unauthorized actions in connected external services. The issue involves the publication of sensitive data without proper access controls.

Recommendations Upgrade to version 8.34 or later to address this issue.

Exploit

Correção

Missing Authorization

Information Disclosure

Enumeração de Fraquezas

CWE-862

CWE-200

Identificadores relacionados

CVE-2026-30845

Produtos afetados

Wekan

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30845.json · Exploit
• https://github.com/wekan/wekan/commit/8c00adc6b865653bd717a946dd646eb54ac78c9c · Correção
• https://github.com/wekan/wekan/releases/tag/v8.34 · Nota
• https://osv.dev/vulnerability/CVE-2026-30845 · Aviso do Fabricante
• https://securitylab.github.com/advisories/GHSL-2026-036_Wekan · Nota
• https://t.me/cveNotify/155096 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-30845 · Nota de Segurança