Vulnerabilidades en WeKan
35 resultadosAnálisis Vexday
WeKan apresenta 10 vulnerabilidades registradas, nenhuma atualmente sob ataque ativo ou classificada como crítica, indicando risco moderado e estável. A fraqueza dominante (CWE-863 - Controle de Acesso Inadequado) sugere problemas estruturais em autorização, mais relevantes para ambientes internos. Não há atividade recente de divulgação, permitindo planejamento deliberado de mitigação.
CVE-2026-68559MEDIUMWekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)EPSS 0.4%CVE-2026-53447MEDIUMWekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by IDEPSS 0.4%CVE-2026-25563HIGHWeKan < 8.19 Checklist Creation Cross-Board IDOREPSS 0.4%CVE-2026-25561HIGHWeKan < 8.19 Attachment Upload Object Relationship Validation BypassEPSS 0.4%CVE-2026-25564HIGHWeKan < 8.19 Checklist Deletion IDOR via Missing Relationship ValidationEPSS 0.4%CVE-2026-25565HIGHWeKan < 8.19 Read-only Board Roles Can Update CardsEPSS 0.4%CVE-2026-68558HIGHWekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)EPSS 0.4%CVE-2026-41455MEDIUMWeKan < 8.35 SSRF via Webhook URLEPSS 0.4%CVE-2026-30843CRITICALWekan has Cross-Board IDOR in Custom Fields Update EndpointsEPSS 0.4%CVE-2026-25562MEDIUMWeKan < 8.19 Attachments Publication Information DisclosureEPSS 0.4%CVE-2026-59154MEDIUMWekan: Checklist direct DDP updates can write checklist data into private boardsEPSS 0.4%CVE-2026-68900HIGHWekan: Stored XSS in HTML board exports through a card-title second parseEPSS 0.4%CVE-2026-25568HIGHWeKan < 8.19 allowPrivateOnly Setting Enforcement BypassEPSS 0.3%CVE-2026-25567MEDIUMWeKan < 8.19 Card Comment Author Spoofing via User-controlled authorIdEPSS 0.3%CVE-2026-25566HIGHWeKan < 8.19 Cross-board Card Move Without Destination AuthorizationEPSS 0.3%