CVE-2026-30845

MEDIUM EPSS 20.7%
Published Mar 6, 20263mo ago · Modified Jun 17, 20261w ago
6.9 CVSS 4.0
Medium
Find Similar
Published Mar 6, 2026 3mo ago
Last Modified Jun 17, 2026 1w ago

Description

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the board composite publication in Wekan publishes all integration data for a board without any field filtering, exposing sensitive fields including webhook URLs and authentication tokens to any subscriber. Since board publications are accessible to all board members regardless of their role (including read-only and comment-only users), and even to unauthenticated DDP clients for public boards, any user who can access a board can retrieve its webhook credentials. This token leak allows attackers to make unauthenticated requests to the exposed webhooks, potentially triggering unauthorized actions in connected external services. This issue has been fixed in version 8.34.

CVSS Details

Base Score
6.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
20.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure
CWE-862 Missing Authorization Authorization

Affected Products 1

VendorProductVersionRange
wekan_projectwekan*≥8.31  –  <8.33

References 3

  • github.com https://github.com/wekan/wekan/commit/8c00adc6b865653bd717a946dd646eb54ac78c9c
    Patch
  • github.com https://github.com/wekan/wekan/releases/tag/v8.34
    Release Notes
  • securitylab.github.com https://securitylab.github.com/advisories/GHSL-2026-036_Wekan/
    Third Party Advisory

Remediation

  • github.com https://github.com/wekan/wekan/commit/8c00adc6b865653bd717a946dd646eb54ac78c9c
    Patch