Wekan: Shell Injection via Avatar Upload

Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)

WeKan < 8.19 LDAP Authentication Filter Injection

Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook

Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule

WeKan < 8.20 Migration Functionality Insufficient Permission Checks

Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback

Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)

Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)

WeKan < 8.35 SSRF via Webhook URL

WeKan < 8.35 Missing Authorization via Integration REST API

Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication

Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading

Wekan:hell Injection in External Antivirus Scanner Path via asyncExec

Wekan: Stored XSS in HTML board exports through a card-title second parse

Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin

Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication

WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation

WeKan < 8.19 Checklist Creation Cross-Board IDOR

WeKan < 8.19 Attachment Upload Object Relationship Validation Bypass

Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards

Wekan: Arbitrary file read and server DoS via attachment versions.original.path

WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service

Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)

Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID

Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops)

Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens

Wekan has Cross-Board IDOR in Custom Fields Update Endpoints

WeKan < 8.19 Read-only Board Roles Can Update Cards

Wekan: Server-Side Request Forgery (SSRF) via webhook integration URLs

WeKan < 8.19 Cross-board Card Move Without Destination Authorization

Wekan: Checklist direct DDP updates can write checklist data into private boards

WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass

WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId

WeKan < 8.19 Attachments Publication Information Disclosure