CVE-2026-52892 - Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops)

Back Back to CVE browser

MEDIUM

Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops)

Published Jul 15, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.46%

Description

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAccess instead of write-level Authentication.checkBoardWriteAccess for mutating custom-field routes. A read-only board member can call POST, PUT, and DELETE handlers for /api/boards/:boardId/custom-fields and custom-field dropdown items to create, update, or delete board custom fields. This issue is fixed in version 9.32.

Affected products

Vendor Wekan Product Wekan Default
unknown
Affected
- < 9.32

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Wekan	Wekan	unknown	Affected < 9.32

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44830
Advisory
https://github.com/wekan/wekan/commit/70db04a93fedabe40331f21f86e6bdc91625914e
x_refsource_MISC
https://github.com/wekan/wekan/releases/tag/v9.32
x_refsource_MISC
https://github.com/wekan/wekan/security/advisories/GHSA-6733-4wgq-8xvr
x_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44830		Advisory
https://github.com/wekan/wekan/commit/70db04a93fedabe40331f21f86e6bdc91625914e		x_refsource_MISC
https://github.com/wekan/wekan/releases/tag/v9.32		x_refsource_MISC
https://github.com/wekan/wekan/security/advisories/GHSA-6733-4wgq-8xvr		x_refsource_CONFIRM

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitHub_M

Published Jul 15, 2026

Updated Jul 16, 2026

Reserved Jun 8, 2026

Link CVE-2026-52892

CISA Vulnrichment

Updated Jul 16, 2026

NVD

Status Deferred

Modified Jul 16, 2026

Link CVE-2026-52892

Red Hat

No data

ENISA EUVD

Assigner GitHub_M

Published Jul 15, 2026

Updated Jul 16, 2026

Link EUVD-2026-44830

GitHub

No data