Vulnerabilidades en wekan
28 resultadosAnálisis Vexday
Wekan apresenta atividade de vulnerabilidades muito elevada, com 11 CVEs publicadas nos últimos 90 dias, indicando risco recente significativo; embora nenhuma esteja sob ataque ativo confirmado, 3 vulnerabilidades críticas demandam atenção imediata. A fraqueza dominante é ausência de verificação de autorização (CWE-862), típica de sistemas de gerenciamento, representando o vetor de risco estrutural mais preocupante.
CVE-2026-25560HIGHWeKan < 8.19 LDAP Authentication Filter InjectionEPSS 0.7%CVE-2026-52891CRITICALWekan: Shell Injection via Avatar UploadEPSS 0.4%CVE-2026-55652CRITICALWekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)EPSS 0.4%CVE-2026-30846HIGHWekan Exposes All Global Webhook Integrations through globalwebhooks PublicationEPSS 0.3%CVE-2026-25859HIGHWeKan < 8.20 Migration Functionality Insufficient Permission ChecksEPSS 0.3%CVE-2026-52890HIGHWekan: Arbitrary file read and server DoS via attachment versions.original.pathEPSS 0.3%CVE-2026-52893CRITICALWekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hookEPSS 0.3%CVE-2026-30845MEDIUMWekan Exposes Sensitive Data through Lack of Field Filtering During Board PublicationEPSS 0.3%CVE-2026-25562MEDIUMWeKan < 8.19 Attachments Publication Information DisclosureEPSS 0.3%CVE-2026-53446MEDIUMWekan: Server-Side Request Forgery (SSRF) via webhook integration URLsEPSS 0.3%CVE-2026-25561HIGHWeKan < 8.19 Attachment Upload Object Relationship Validation BypassEPSS 0.3%CVE-2026-25564HIGHWeKan < 8.19 Checklist Deletion IDOR via Missing Relationship ValidationEPSS 0.3%CVE-2026-25563HIGHWeKan < 8.19 Checklist Creation Cross-Board IDOREPSS 0.3%CVE-2026-25565HIGHWeKan < 8.19 Read-only Board Roles Can Update CardsEPSS 0.3%CVE-2026-41454HIGHWeKan < 8.35 Missing Authorization via Integration REST APIEPSS 0.3%CVE-2026-52892MEDIUMWekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops)EPSS 0.3%CVE-2026-25567MEDIUMWeKan < 8.19 Card Comment Author Spoofing via User-controlled authorIdEPSS 0.2%CVE-2026-55234HIGHWekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)EPSS 0.2%CVE-2026-53444HIGHWekan: Missing authorization on OIDC Meteor methods allows privilege escalation to adminEPSS 0.2%CVE-2026-53445HIGHWekan: Authorization bypass in copyBoard DDP method allows any user to copy private boardsEPSS 0.2%