CVE-2026-52892: Wekan Authentication Bypass Vulnerability

CVE-2026-52892 Overview

CVE-2026-52892 is a missing authorization vulnerability [CWE-862] in Wekan, an open source kanban board built with Meteor. Versions prior to 9.32 use read-level access checks on REST handlers that mutate board custom fields. The REST handlers in server/models/customFields.js call Authentication.checkBoardAccess instead of Authentication.checkBoardWriteAccess on POST, PUT, and DELETE routes. As a result, a read-only board member can create, update, or delete custom fields and their dropdown items on any board they can view. The issue is fixed in Wekan version 9.32.

Critical Impact
Read-only board members can tamper with board custom fields and dropdown items through /api/boards/:boardId/custom-fields, breaking data integrity for all board users.

Affected Products

Wekan versions prior to 9.32
REST API endpoint /api/boards/:boardId/custom-fields
Custom field dropdown item REST handlers in server/models/customFields.js

Discovery Timeline

2026-07-15 - CVE-2026-52892 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-52892

Vulnerability Analysis

Wekan exposes REST endpoints for managing board custom fields. The mutating handlers for POST, PUT, and DELETE operations on /api/boards/:boardId/custom-fields and the associated dropdown item routes wrap their logic with an authentication check. That check confirms the caller is a board member but does not confirm they hold write privileges. Read-only members pass the check and reach the mutation logic, letting them insert, modify, or remove custom fields belonging to the board. The confidentiality of board contents is preserved, but integrity is broken because unauthorized users can permanently alter shared structural data.

Root Cause

The root cause is an authorization scope mismatch. The handlers call Authentication.checkBoardAccess, which validates read membership, when they should call Authentication.checkBoardWriteAccess. This is a classic [CWE-862] Missing Authorization defect where the enforcement primitive exists in the codebase but is not applied to state-changing routes.

Attack Vector

An attacker needs a valid Wekan account and read-only membership on the target board. Using the REST API with their session token, they issue POST, PUT, or DELETE requests to the custom fields endpoints. No user interaction from privileged users is required, and the requests can be automated with any HTTP client.

javascript

// Security patch in server/models/customFields.js
// Fix GHSA-6733-4wgq-8xvr: enforce write-level access on mutating routes
 WebApp.handlers.post('/api/boards/:boardId/custom-fields', async function(req, res) {
   const paramBoardId = req.params.boardId;
-  await Authentication.checkBoardAccess(req.userId, paramBoardId);
+  await Authentication.checkBoardWriteAccess(req.userId, paramBoardId);
   const board = await ReactiveCache.getBoard(paramBoardId);
   const id = await CustomFields.direct.insertAsync({
     name: req.body.name,

Source: GitHub Wekan Commit 70db04a

Detection Methods for CVE-2026-52892

Indicators of Compromise

Unexpected POST, PUT, or DELETE requests to /api/boards/:boardId/custom-fields originating from accounts that only hold read-only board membership.
Custom fields or dropdown items appearing, changing, or disappearing on boards without a matching audit entry from a board admin.
API calls to custom field routes from user tokens that historically only issued GET requests.

Detection Strategies

Enable request logging on the Wekan Node.js process and alert on 4xx/2xx responses to custom field mutation routes correlated with the caller's board role.
Diff MongoDB customFields collection snapshots to identify changes not attributable to admin sessions.
Review reverse proxy logs (nginx, Traefik) for HTTP verbs other than GET targeting the custom fields path.

Monitoring Recommendations

Forward Wekan application and web server logs to a centralized log platform and build queries for the custom field endpoints.
Baseline normal API usage per user and alert on role-inconsistent verbs against /api/boards/*/custom-fields*.
Track version metadata from Wekan deployments so instances running versions prior to 9.32 are flagged in asset inventory.

How to Mitigate CVE-2026-52892

Immediate Actions Required

Upgrade Wekan to version 9.32 or later, which replaces checkBoardAccess with checkBoardWriteAccess on the affected handlers.
Audit board custom fields and dropdown items for unauthorized additions, edits, or deletions since the vulnerable version was deployed.
Review board membership and remove any read-only accounts that are no longer required, reducing the pool of potential abusers.

Patch Information

The fix is delivered in the Wekan v9.32 release. The corrective change is documented in commit 70db04a93fedabe40331f21f86e6bdc91625914e and described in GitHub Security Advisory GHSA-6733-4wgq-8xvr.

Workarounds

If immediate patching is not feasible, block POST, PUT, and DELETE methods to /api/boards/*/custom-fields* at the reverse proxy for non-admin users.
Restrict Wekan REST API access to a trusted internal network or VPN while planning the upgrade.
Temporarily downgrade sensitive boards' membership to remove non-trusted read-only users until the patch is applied.

bash

# Example nginx snippet to block mutating verbs on custom field routes
location ~ ^/api/boards/[^/]+/custom-fields {
    limit_except GET {
        deny all;
    }
    proxy_pass http://wekan_upstream;
}