PT-2026-34568 · Wekan · Wekan

Rodolphe Ghio + 1 · Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-41454

NVD

CVSS v3.1

8.3

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification. Attackers can enumerate integrations including webhook URLs, create new integrations, modify or delete existing integrations, and manage integration activities by exploiting insufficient authorization checks in the JsonRoutes REST handlers.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-41454

Affected Products

Wekan

References · 4

• https://github.com/wekan/wekan/commit/2cd702f48df2b8aef0e7381685f8e089986a18a4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41454 · Security Note
• https://github.com/wekan/wekan/releases/tag/v8.35 · Note
• https://vulncheck.com/advisories/wekan-missing-authorization-via-integration-rest-api · Note