Medium severity · published Jul 10, 2026
CVE-2026-59154
Wekan: Checklist direct DDP updates can write checklist data into private boards
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
Wekan is open source kanban built with Meteor. Prior to 9.64, Wekan has a cross-board authorization bypass in the direct Meteor collection allow rules for Checklists and ChecklistItems because updates are authorized only against the current source doc.cardId and do not inspect the destination cardId or boardId in the update modifier, allowing a low-privileged authenticated user with write access to one board and knowledge of a target private card id to create checklist data on an accessible card and move it into a private board where they are not a member. This issue is fixed in version 9.64.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
wekan · wekan
< 9.64 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59154
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59154
github.com
https://github.com/wekan/wekan/commit/b1ca76007b9a295fd029dfefc1a2d1d6f1920835
github.com
https://github.com/wekan/wekan/releases/tag/v9.64
github.com
https://github.com/wekan/wekan/security/advisories/GHSA-gv8h-5p3p-6hx7
More from wekan
9.9
CVE-2026-52891
Wekan: Shell Injection via Avatar Upload
9.8
CVE-2026-55652
Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)
9.8
CVE-2026-25560
WeKan < 8.19 LDAP Authentication Filter Injection
9.2
CVE-2026-52893
Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook
8.8
CVE-2026-68561
Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule