Security Advisory

CVE-2026-52892

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-15 21:08:42

Last updated 2026-07-16 15:12:17

Assigner GitHub_M

CVSS score 6.5

State PUBLISHED

Description

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAccess instead of write-level Authentication.checkBoardWriteAccess for mutating custom-field routes. A read-only board member can call POST, PUT, and DELETE handlers for /api/boards/:boardId/custom-fields and custom-field dropdown items to create, update, or delete board custom fields. This issue is fixed in version 9.32.

← Browse all CVEs View on cve.org ↗