PT-2026-57225 · Wekan · Wekan

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-59154

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.64

Description A cross-board authorization bypass exists in the direct Meteor collection allow rules for Checklists and ChecklistItems. The issue occurs because updates are authorized only against the current source doc.cardId and fail to inspect the destination cardId or boardId within the update modifier. This allows a low-privileged authenticated user with write access to one board and knowledge of a target private card ID to create checklist data on an accessible card and move it into a private board where they are not a member.

Recommendations Update to version 9.64.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-59154

Affected Products

Wekan

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-59154 · Security Note
• https://github.com/wekan/wekan/commit/b1ca76007b9a295fd029dfefc1a2d1d6f1920835 · Note
• https://github.com/wekan/wekan/releases/tag/v9.64 · Note
• https://github.com/wekan/wekan/security/advisories/GHSA-gv8h-5p3p-6hx7 · Note
• https://twitter.com/CVEnew/status/2075613559443087704 · Twitter Post
• https://twitter.com/infoflowcloud/status/2075615024958087471 · Twitter Post