Vulnerabilidades en Wekan
35 resultadosAnálisis Vexday
Wekan apresenta 5 vulnerabilidades catalogadas, com 3 delas classificadas como críticas, predominantemente relacionadas a exposição de informações (CWE-200). Nenhuma vulnerabilidade está sob exploração ativa conforme KEV, e não há registros de novos achados nos últimos 90 dias, sugerindo um cenário de risco estabilizado mas remanescente na base legada da plataforma.
CVE-2026-68559MEDIUMWekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)EPSS 0.4%CVE-2026-53447MEDIUMWekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by IDEPSS 0.4%CVE-2026-25563HIGHWeKan < 8.19 Checklist Creation Cross-Board IDOREPSS 0.4%CVE-2026-25561HIGHWeKan < 8.19 Attachment Upload Object Relationship Validation BypassEPSS 0.4%CVE-2026-25564HIGHWeKan < 8.19 Checklist Deletion IDOR via Missing Relationship ValidationEPSS 0.4%CVE-2026-25565HIGHWeKan < 8.19 Read-only Board Roles Can Update CardsEPSS 0.4%CVE-2026-68558HIGHWekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)EPSS 0.4%CVE-2026-41455MEDIUMWeKan < 8.35 SSRF via Webhook URLEPSS 0.4%CVE-2026-30843CRITICALWekan has Cross-Board IDOR in Custom Fields Update EndpointsEPSS 0.4%CVE-2026-25562MEDIUMWeKan < 8.19 Attachments Publication Information DisclosureEPSS 0.4%CVE-2026-59154MEDIUMWekan: Checklist direct DDP updates can write checklist data into private boardsEPSS 0.4%CVE-2026-68900HIGHWekan: Stored XSS in HTML board exports through a card-title second parseEPSS 0.4%CVE-2026-25568HIGHWeKan < 8.19 allowPrivateOnly Setting Enforcement BypassEPSS 0.3%CVE-2026-25567MEDIUMWeKan < 8.19 Card Comment Author Spoofing via User-controlled authorIdEPSS 0.3%CVE-2026-25566HIGHWeKan < 8.19 Cross-board Card Move Without Destination AuthorizationEPSS 0.3%