PT-2026-60318 · Wekan · Wekan

Published 2026-07-15 · Updated 2026-07-16 · CVE-2026-52892

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.32

Description REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAccess() instead of write-level Authentication.checkBoardWriteAccess() for mutating custom-field routes. This allows a board member with read-only permissions to create, update, or delete board custom fields and dropdown items by calling the /api/boards/:boardId/custom-fields endpoint via POST, PUT, and DELETE methods.

Recommendations Update to version 9.32.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-52892

Affected Products

Wekan

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-52892 · Security Note
• https://github.com/wekan/wekan/commit/70db04a93fedabe40331f21f86e6bdc91625914e · Note
• https://github.com/wekan/wekan/releases/tag/v9.32 · Note
• https://github.com/wekan/wekan/security/advisories/GHSA-6733-4wgq-8xvr · Note
• https://twitter.com/VulmonFeeds/status/2077557081297527244 · Twitter Post