PT-2026-23749 · Wekan+1 · Wekan

Xet7 · Publicado 2026-03-06 · Atualizado 2026-03-11 · CVE-2026-30847

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Wekan versions 8.31.0 through 8.33

Description Wekan is an open source kanban tool built with Meteor. The notificationUsers publication in Wekan publishes user documents without filtering fields. This causes the ReactiveCache.getUsers() call to return all fields, including sensitive data such as bcrypt password hashes, active session login tokens, email verification tokens, full email addresses, and stored OAuth tokens. Custom publications return all cursor fields, meaning all subscribers receive complete user documents. Any authenticated user triggering this publication can collect credentials and session tokens for other users, potentially enabling password cracking, session hijacking, and account takeover.

Recommendations Update to version 8.34 or later.

Exploit

Correção

Improper Authorization

Information Disclosure

Enumeração de Fraquezas

CWE-285

CWE-200

Identificadores relacionados

CVE-2026-30847

Produtos afetados

Wekan

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30847.json · Exploit
• https://github.com/wekan/wekan/commit/1c8667eae8b28739e43569b612ffdb2693c6b1ce · Correção
• https://github.com/wekan/wekan/releases/tag/v8.34 · Nota
• https://securitylab.github.com/advisories/GHSL-2026-035_Wekan · Nota
• https://t.me/cveNotify/155093 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-30847 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-30847 · Nota de Segurança