PT-2026-60320 · Wekan · Wekan

Published 2026-07-15 · Updated 2026-07-15 · CVE-2026-53444

Mitre

CVSS v4.0

7.6

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/oidc server.js, server/models/org.js, and server/models/team.js are globally callable without the admin authorization checks used by their non-OIDC counterparts. Authenticated users can call setCreateOrgFromOidc, setOrgAllFieldsFromOidc, setCreateTeamFromOidc, setTeamAllFieldsFromOidc, boardRoutineOnLogin, or groupRoutineOnLogin to create or modify organizations and teams, and groupRoutineOnLogin can grant global admin privileges when PROPAGATE OIDC DATA is enabled. This issue is fixed in version 9.32.

Fix

Missing Authorization

Improper Privilege Management

Weakness Enumeration

CWE-862

CWE-269

Related Identifiers

CVE-2026-53444

Affected Products

Wekan

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-53444 · Security Note
• https://github.com/wekan/wekan/security/advisories/GHSA-cv95-8h7c-2ffq · Note
• https://github.com/wekan/wekan/releases/tag/v9.32 · Note
• https://github.com/wekan/wekan/commit/305864f0c77456ad0f2c1e616266c8a06749c951 · Note