PT-2026-23745 · Wekan+1 · Wekan

Xet7 · Published 2026-03-06 · Updated 2026-03-11 · CVE-2026-30845

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wekan versions 8.31.0 through 8.33

Description Wekan is an open source kanban tool. In affected versions, the board composite publication publishes all integration data for a board without field filtering, exposing sensitive information like webhook URLs and authentication tokens to any subscriber. Board publications are accessible to all board members, regardless of their role, and even to unauthenticated DDP clients for public boards. This allows any user with board access to retrieve webhook credentials. This token leak enables attackers to make unauthenticated requests to exposed webhooks, potentially triggering unauthorized actions in connected external services. The issue involves the publication of sensitive data without proper access controls.

Recommendations Upgrade to version 8.34 or later to address this issue.

Exploit

Fix

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-862

CWE-200

Related Identifiers

CVE-2026-30845

Affected Products

Wekan

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30845.json · Exploit
• https://github.com/wekan/wekan/commit/8c00adc6b865653bd717a946dd646eb54ac78c9c · Patch
• https://osv.dev/vulnerability/CVE-2026-30845 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30845 · Security Note
• https://github.com/wekan/wekan/releases/tag/v8.34 · Note
• https://securitylab.github.com/advisories/GHSL-2026-036_Wekan · Note
• https://t.me/cveNotify/155096 · Telegram Post