Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule

WeKan < 8.20 Migration Functionality Insufficient Permission Checks

Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback

Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)

Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)

WeKan < 8.35 SSRF via Webhook URL

WeKan < 8.35 Missing Authorization via Integration REST API

Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication

Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading

Wekan:hell Injection in External Antivirus Scanner Path via asyncExec

Wekan: Stored XSS in HTML board exports through a card-title second parse

Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin

Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication

WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation

WeKan < 8.19 Checklist Creation Cross-Board IDOR

WeKan < 8.19 Attachment Upload Object Relationship Validation Bypass

Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards

Wekan: Arbitrary file read and server DoS via attachment versions.original.path