Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M

CVE-2026-52892Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops)

Medium 6.5

In plain English

A medium-severity missing authorization in wekan from wekan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 59.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAccess instead of write-level Authentication.checkBoardWriteAccess for mutating custom-field routes. A read-only board member can call POST, PUT, and DELETE handlers for /api/boards/:boardId/custom-fields and custom-field dropdown items to create, update, or delete board custom fields. This issue is fixed in version 9.32.

Affected products (as reported)

Vendor	Product	Versions
wekan	wekan	< 9.32

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/wekan/wekan/security/advisories/GHSA-6733-4wgq-8xvr x_refsource_CONFIRM
https://github.com/wekan/wekan/commit/70db04a93fedabe40331f21f86e6bdc91625914e x_refsource_MISC
https://github.com/wekan/wekan/releases/tag/v9.32 x_refsource_MISC