Vulnerabilities in WeKan

28 results
Vexday analysis

WeKan apresenta 10 vulnerabilidades registradas, nenhuma atualmente sob ataque ativo ou classificada como crítica, indicando risco moderado e estável. A fraqueza dominante (CWE-863 - Controle de Acesso Inadequado) sugere problemas estruturais em autorização, mais relevantes para ambientes internos. Não há atividade recente de divulgação, permitindo planejamento deliberado de mitigação.

CVE-2026-41455MEDIUMWeKan < 8.35 SSRF via Webhook URLEPSS 0.2%CVE-2026-30847CRITICALWekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session TokensEPSS 0.2%CVE-2026-30844CRITICALWekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL LoadingEPSS 0.2%CVE-2026-53447MEDIUMWekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by IDEPSS 0.2%CVE-2026-25566HIGHWeKan < 8.19 Cross-board Card Move Without Destination AuthorizationEPSS 0.2%CVE-2026-30843CRITICALWekan has Cross-Board IDOR in Custom Fields Update EndpointsEPSS 0.2%CVE-2026-59154MEDIUMWekan: Checklist direct DDP updates can write checklist data into private boardsEPSS 0.2%CVE-2026-25568HIGHWeKan < 8.19 allowPrivateOnly Setting Enforcement BypassEPSS 0.2%