Vulnerability · Published Apr 22, 2026 · Assigned by VulnCheck

CVE-2026-41454WeKan < 8.35 Missing Authorization via Integration REST API

High 8.3

In plain English

A high-severity missing authorization in wekan from wekan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.3%top 80.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification. Attackers can enumerate integrations including webhook URLs, create new integrations, modify or delete existing integrations, and manage integration activities by exploiting insufficient authorization checks in the JsonRoutes REST handlers.

Affected products (as reported)

Vendor	Product	Versions
wekan	wekan	0 – before 8.35.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References

https://github.com/wekan/wekan/releases/tag/v8.35 release-notes
https://github.com/wekan/wekan/commit/2cd702f48df2b8aef0e7381685f8e089986a18a4 patch
https://www.vulncheck.com/advisories/wekan-missing-authorization-via-integration-rest-api third-party-advisory