Wekan API Flaw Grants Board Members Admin Powers

The National Vulnerability Database has detailed CVE-2026-41454, a high-severity (CVSS 8.3) missing authorization vulnerability impacting Wekan versions prior to 8.35. This flaw resides within the Integration REST API endpoints, allowing authenticated board members to escalate privileges and perform administrative actions without proper verification. This isn’t a simple oversight; it’s a fundamental breakdown in access control.

Attackers can leverage this vulnerability to enumerate integrations, including sensitive webhook URLs. More critically, they can create new integrations, modify or delete existing ones, and manage integration activities. This level of control, stemming from insufficient authorization checks in the JsonRoutes REST handlers, means a standard board member can effectively hijack critical system functions that should be reserved for administrators. It’s a direct path to broader system compromise and data exfiltration.

For defenders, this is a clear call to action. Any Wekan deployment running versions older than 8.35 is exposed. The attacker’s calculus here is straightforward: gain a foothold as a regular user, then exploit this flaw to gain admin-level control. This bypasses much of the typical privilege escalation detection and makes lateral movement significantly easier for an adversary.