CVE-2026-2209: Wekan Auth Bypass Vulnerability

CVE-2026-2209 Overview

A vulnerability was detected in WeKan up to version 8.18. The affected element is the function setCreateTranslation of the file client/components/settings/translationBody.js of the component Custom Translation Handler. The manipulation results in improper authorization, allowing non-administrative users to modify custom translations. The attack can be launched remotely by authenticated users with low privileges.

Critical Impact

Non-admin users can bypass authorization controls to create, modify, or delete custom translations in WeKan, potentially enabling privilege escalation or application tampering through Insecure Direct Object Reference (IDOR).

Affected Products

• WeKan versions up to and including 8.18
• WeKan Custom Translation Handler component
• WeKan installations with custom translation features enabled

Discovery Timeline

• 2026-02-08 - CVE CVE-2026-2209 published to NVD
• 2026-02-11 - Last updated in NVD database

Technical Details for CVE-2026-2209

Vulnerability Analysis

This vulnerability represents an Insecure Direct Object Reference (IDOR) issue combined with improper authorization in WeKan's Custom Translation Handler. The core problem stems from missing administrative privilege checks in the setCreateTranslation function, allowing any authenticated user to manipulate translation records that should be restricted to administrators only.

The vulnerability exists in the client-side event handler and the server-side method implementation. Prior to the patch, the Translation.remove() function was called directly from the client without proper server-side authorization validation. Additionally, the setCreateTranslation method lacked verification that the requesting user possessed administrative privileges before allowing translation modifications.

Root Cause

The root cause is the absence of proper authorization checks in the translation management functions. The vulnerable code allowed direct database operations from the client side without validating user roles. The Translation.remove() call was executed directly in the client-side template events, bypassing any server-side permission validation. Furthermore, server-side methods handling translation creation and modification failed to verify that the current user had administrative privileges (isAdmin flag) before processing the request.

Attack Vector

An attacker with valid low-privilege user credentials can exploit this vulnerability remotely over the network. By manipulating the translation management functionality, an authenticated non-admin user can:

1. Create arbitrary custom translations that could inject malicious content
2. Modify existing translations to change application behavior or display
3. Delete legitimate translations to disrupt application functionality

The attack requires no user interaction beyond initial authentication and can be performed with low complexity against any vulnerable WeKan instance.

Vulnerable Code (Before Patch):

Template.settingsTranslationPopup.events({
  'click #deleteButton'(event) {
    event.preventDefault();
    Translation.remove(this.translationId);
    Popup.back();
  }
});

Source: Wekan Commit f244a43

Security Patch (After Fix):

Template.settingsTranslationPopup.events({
  'click #deleteButton'(event) {
    event.preventDefault();
    Meteor.call('deleteTranslation', this.translationId);
    Popup.back();
  }
});

The patch moves the delete operation to a server-side method call that includes proper authorization checks.

Server-Side Authorization Fix:

      check(text, String);
      check(translationText, String);

      if (!ReactiveCache.getCurrentUser()?.isAdmin) {
        throw new Meteor.Error('not-authorized');
      }

      const nTexts = ReactiveCache.getTranslations({ language, text }).length;
      if (nTexts > 0) {
        throw new Meteor.Error('text-already-taken');

Source: Wekan Commit f244a43

Detection Methods for CVE-2026-2209

Indicators of Compromise

• Unexpected changes to custom translations in WeKan settings
• Translation modifications attributed to non-admin user accounts in application logs
• Unusual API calls to translation-related endpoints from low-privilege sessions
• Anomalous activity patterns involving the /settings/translation routes

Detection Strategies

• Monitor WeKan application logs for translation modification events initiated by non-administrative users
• Implement audit logging for all administrative functions including translation management
• Review Meteor method calls to setCreateTranslation, deleteTranslation, and related functions for unauthorized access attempts
• Deploy application-level monitoring to detect IDOR attack patterns against object references

Monitoring Recommendations

• Enable verbose logging for WeKan's settings and translation components
• Configure alerts for authorization failure events (not-authorized errors) in Meteor method calls
• Regularly audit user role assignments and verify admin privilege consistency
• Implement network-level monitoring for unusual patterns in authenticated session activity

How to Mitigate CVE-2026-2209

Immediate Actions Required

• Upgrade WeKan to version 8.19 or later immediately
• Review audit logs for any unauthorized translation modifications prior to patching
• Verify that no malicious translations were added by non-admin users
• Confirm all administrative accounts have appropriate privilege levels

Patch Information

The vulnerability has been addressed in WeKan version 8.19. The security fix is identified by commit f244a43771f6ebf40218b83b9f46dba6b940d7de. The patch implements proper server-side authorization checks by validating the isAdmin flag on the current user before allowing translation operations. Direct client-side database operations have been replaced with secure server-side method calls that enforce proper access controls.

Upgrade resources:

• Wekan Release v8.19
• Security Patch Commit

Workarounds

• Restrict access to WeKan translation settings to trusted administrative users only at the network level
• Implement a reverse proxy with additional authorization rules for sensitive administrative endpoints
• Temporarily disable custom translation functionality if immediate patching is not possible
• Monitor and audit all translation-related activities until the patch can be applied

# Configuration example
# If using a reverse proxy, restrict access to translation settings endpoints
# Example nginx configuration to limit access by IP or authentication
location /settings/translation {
    # Allow only trusted admin IPs
    allow 10.0.0.0/8;
    deny all;
    
    # Or require additional authentication
    auth_basic "Admin Area";
    auth_basic_user_file /etc/nginx/.htpasswd;
    
    proxy_pass http://wekan_backend;
}