Vulnerability · Published Mar 6, 2026 · Assigned by GitHub_M

CVE-2026-30846Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication

High 8.7

In plain English

A high-severity missing authentication in Wekan from Wekan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 66.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the globalwebhooks publication exposes all global webhook integrations—including sensitive url and token fields—without performing any authentication check on the server side. Although the subscription is normally invoked from the admin settings page, the server-side publication has no access control, meaning any DDP client, including unauthenticated ones, can subscribe and receive the data. This allows an unauthenticated attacker to retrieve global webhook URLs and authentication tokens, potentially enabling unauthorized use of those webhooks and access to connected external services. This issue has been fixed in version 8.34.

Affected products (as reported)

Vendor	Product	Versions
Wekan	Wekan	>= 8.31.0, < 8.34

Weakness: CWE-306, CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:N

References

https://securitylab.github.com/advisories/GHSL-2026-037_Wekan/ x_refsource_CONFIRM
https://github.com/wekan/wekan/commit/1ee9b2e917104f54c035f6426169a28fedecbdb6 x_refsource_MISC
https://github.com/wekan/wekan/releases/tag/v8.34 x_refsource_MISC