High severity · published Apr 22, 2026
CVE-2026-41454
WeKan < 8.35 Missing Authorization via Integration REST API
8.3
CVSS
0.3%
EPSS
No
On KEV
Description
WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification. Attackers can enumerate integrations including webhook URLs, create new integrations, modify or delete existing integrations, and manage integration activities by exploiting insufficient authorization checks in the JsonRoutes REST handlers.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
wekan · wekan
before 8.35.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41454
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41454
github.com
https://github.com/wekan/wekan/commit/2cd702f48df2b8aef0e7381685f8e089986a18a4
github.com
https://github.com/wekan/wekan/releases/tag/v8.35
www.vulncheck.com
https://www.vulncheck.com/advisories/wekan-missing-authorization-via-integration-rest-api
More from wekan
9.9
CVE-2026-52891
Wekan: Shell Injection via Avatar Upload
9.8
CVE-2026-55652
Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)
9.8
CVE-2026-25560
WeKan < 8.19 LDAP Authentication Filter Injection
9.2
CVE-2026-52893
Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook
8.8
CVE-2026-68561
Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule