CVE-2026-30845: Wekan Information Disclosure Vulnerability

CVE-2026-30845 Overview

CVE-2026-30845 is a sensitive data exposure vulnerability affecting Wekan, an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the board composite publication in Wekan publishes all integration data for a board without any field filtering, exposing sensitive fields including webhook URLs and authentication tokens to any subscriber.

Since board publications are accessible to all board members regardless of their role (including read-only and comment-only users), and even to unauthenticated DDP (Distributed Data Protocol) clients for public boards, any user who can access a board can retrieve its webhook credentials. This token leak allows attackers to make unauthenticated requests to the exposed webhooks, potentially triggering unauthorized actions in connected external services.

Critical Impact

Webhook URLs and authentication tokens are exposed to unauthorized users, enabling attackers to trigger unauthorized actions in connected external services without authentication.

Affected Products

• Wekan versions 8.31.0 through 8.33
• Wekan installations with configured webhook integrations
• Public boards accessible via unauthenticated DDP clients

Discovery Timeline

• 2026-03-06 - CVE CVE-2026-30845 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30845

Vulnerability Analysis

This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-862 (Missing Authorization). The core issue stems from the board composite publication mechanism in Wekan's Meteor-based architecture failing to implement proper field filtering when publishing integration data.

When a user subscribes to a board's data through Meteor's DDP protocol, the publication sends all integration fields to the client, including sensitive webhook configuration data. This represents a fundamental authorization gap where the system fails to distinguish between users who should have access to operational board data versus those who should have access to administrative integration credentials.

The impact extends beyond simple information disclosure. With exposed webhook URLs and authentication tokens, an attacker can interact with any external services integrated with the board, potentially triggering automated workflows, sending unauthorized notifications, or manipulating connected systems.

Root Cause

The root cause is the absence of field-level filtering in the board composite publication. The Meteor publication responsible for delivering board data to subscribers returns the complete integration document, including fields that should remain server-side only. This design flaw results in sensitive configuration data being transmitted to any client that subscribes to the board, regardless of whether that client has the appropriate administrative privileges to access integration settings.

Attack Vector

The attack vector is network-based and requires minimal privileges. An attacker needs only the ability to subscribe to a board's publication, which is available to:

1. Any board member with any role (including read-only and comment-only)
2. Unauthenticated clients for public boards

Once subscribed, the attacker can inspect the received data to extract webhook URLs and authentication tokens. These credentials can then be used to:

• Make direct requests to external service webhooks
• Impersonate the Wekan integration in external systems
• Trigger automated actions or workflows without authorization
• Potentially pivot to additional systems depending on the integration scope

The vulnerability mechanism involves the DDP subscription returning unfiltered integration data. For technical implementation details, see the GitHub Security Advisory GHSL-2026-036.

Detection Methods for CVE-2026-30845

Indicators of Compromise

• Unusual DDP subscription requests targeting board publications from unexpected client IPs
• Webhook endpoints receiving requests from IP addresses not associated with your Wekan server
• Unexpected activity in external services connected via Wekan integrations
• Access logs showing integration data retrieval by low-privilege users

Detection Strategies

• Monitor DDP connections and subscription patterns for anomalous activity
• Review access logs for integration endpoint queries from non-administrative users
• Audit webhook activity in connected external services for unauthorized calls
• Implement logging on external webhook receivers to detect misuse

Monitoring Recommendations

• Enable detailed logging for Meteor DDP subscriptions and publications
• Configure alerts for webhook invocations from unrecognized source IPs
• Monitor for bulk data retrieval patterns that may indicate credential harvesting
• Review external service audit logs for unexpected integration activity

How to Mitigate CVE-2026-30845

Immediate Actions Required

• Upgrade Wekan to version 8.34 or later immediately
• Rotate all webhook authentication tokens for existing integrations after upgrading
• Review external service logs for any unauthorized webhook activity
• Temporarily disable integrations on sensitive boards until patching is complete

Patch Information

Wekan has addressed this vulnerability in version 8.34. The fix implements proper field filtering in the board composite publication to prevent sensitive integration data from being exposed to unauthorized subscribers. The patch is available via the official commit and the v8.34 release.

Organizations should upgrade to version 8.34 or later as the primary remediation strategy.

Workarounds

• Remove or disable webhook integrations on boards accessible to untrusted users until patching
• Convert public boards to private boards to require authentication for access
• Implement network-level restrictions to limit DDP access to trusted clients
• Use a reverse proxy to filter or restrict access to board subscription endpoints

# Upgrade Wekan to patched version
# For Docker deployments:
docker pull wekanteam/wekan:v8.34
docker-compose down && docker-compose up -d

# For Snap installations:
sudo snap refresh wekan --channel=latest/stable