PT-2026-23749 · Wekan+1 · Wekan

Xet7 · Published 2026-03-06 · Updated 2026-03-11 · CVE-2026-30847

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Wekan versions 8.31.0 through 8.33

Description Wekan is an open source kanban tool built with Meteor. The notificationUsers publication in Wekan publishes user documents without filtering fields. This causes the ReactiveCache.getUsers() call to return all fields, including sensitive data such as bcrypt password hashes, active session login tokens, email verification tokens, full email addresses, and stored OAuth tokens. Custom publications return all cursor fields, meaning all subscribers receive complete user documents. Any authenticated user triggering this publication can collect credentials and session tokens for other users, potentially enabling password cracking, session hijacking, and account takeover.

Recommendations Update to version 8.34 or later.

Exploit

Fix

Improper Authorization

Information Disclosure

Weakness Enumeration

CWE-285

CWE-200

Related Identifiers

CVE-2026-30847

Affected Products

Wekan

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30847.json · Exploit
• https://github.com/wekan/wekan/commit/1c8667eae8b28739e43569b612ffdb2693c6b1ce · Patch
• https://osv.dev/vulnerability/CVE-2026-30847 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30847 · Security Note
• https://github.com/wekan/wekan/releases/tag/v8.34 · Note
• https://securitylab.github.com/advisories/GHSL-2026-035_Wekan · Note
• https://t.me/cveNotify/155093 · Telegram Post