CVE-2026-53444: Wekan Auth Bypass Vulnerability

CVE-2026-53444 Overview

Wekan, an open source kanban board built with Meteor, contains a missing authorization vulnerability in its OpenID Connect (OIDC) integration prior to version 9.32. Several OIDC-related Meteor methods in packages/wekan-oidc/oidc_server.js, server/models/org.js, and server/models/team.js are globally callable over Distributed Data Protocol (DDP) without the administrator authorization checks used by their non-OIDC counterparts. Any authenticated user can invoke setCreateOrgFromOidc, setOrgAllFieldsFromOidc, setCreateTeamFromOidc, setTeamAllFieldsFromOidc, boardRoutineOnLogin, or groupRoutineOnLogin to create or modify organizations and teams. When PROPAGATE_OIDC_DATA is enabled, groupRoutineOnLogin allows an authenticated attacker to grant themselves global administrator privileges.

Critical Impact
Authenticated users can escalate to global administrator on Wekan deployments running with PROPAGATE_OIDC_DATA enabled, taking full control of organizations, teams, and boards.

Affected Products

Wekan versions prior to 9.32
Wekan deployments using the wekan-oidc package
Wekan instances with the PROPAGATE_OIDC_DATA environment variable enabled

Discovery Timeline

2026-07-15 - CVE-2026-53444 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-53444

Vulnerability Analysis

The vulnerability is a missing authorization flaw [CWE-269] in Wekan's OIDC integration. Meteor methods designed as internal helpers for the server-side OIDC login flow were registered on the global Meteor methods namespace without any caller checks. Meteor exposes registered methods over DDP to every connected client by default. Because the OIDC helpers perform privileged writes to organizations, teams, and user records, any authenticated client can call them directly and bypass the administrator-only checks enforced on the equivalent non-OIDC methods such as setCreateOrg and setOrgAllFields.

The most severe path involves groupRoutineOnLogin. When PROPAGATE_OIDC_DATA is enabled, this method assigns isAdmin based on caller-supplied group data, letting an attacker promote their account to global administrator with a single DDP call.

Root Cause

The root cause is the absence of authorization checks distinguishing internal server-side invocations from direct client DDP calls. In Meteor, a server-side call made via Meteor.callAsync has this.connection === null, while a direct client call has a non-null connection. The vulnerable methods did not test this.connection, so they treated authenticated users as trusted internal callers.

Attack Vector

An attacker with any authenticated Wekan account opens a DDP connection and invokes the OIDC helper methods with attacker-controlled arguments. The attacker can create or modify organizations and teams, and, if PROPAGATE_OIDC_DATA is set, invoke groupRoutineOnLogin to acquire global administrator rights.

javascript

// Patch excerpt from packages/wekan-oidc/oidc_server.js
 Meteor.methods({
   'groupRoutineOnLogin': async function(info, userId)
   {
+    // SECURITY (GHSA-cv95-8h7c-2ffq): This method is invoked only server-side
+    // during the OIDC login flow (via Meteor.callAsync from the
+    // OAuth.registerService('oidc') callback above). With PROPAGATE_OIDC_DATA
+    // enabled it grants isAdmin based on the caller-supplied group data, so if
+    // it were callable directly over DDP any authenticated user could promote
+    // themselves to global admin. A server-side method call has
+    // this.connection === null; a direct client call has a non-null
+    // connection. Reject the latter.
+    if (this.connection !== null) {
+      throw new Meteor.Error('not-authorized');
+    }
     check(info, Object);
     check(userId, String);
     var propagateOidcData = process.env.PROPAGATE_OIDC_DATA || false;

Source: GitHub commit 305864f

Detection Methods for CVE-2026-53444

Indicators of Compromise

Unexpected additions to the isAdmin field on user documents in the Wekan MongoDB store, particularly for non-privileged accounts.
Creation or modification of organizations and teams outside of the normal administrative workflow or OIDC login events.
DDP method calls to setCreateOrgFromOidc, setOrgAllFieldsFromOidc, setCreateTeamFromOidc, setTeamAllFieldsFromOidc, boardRoutineOnLogin, or groupRoutineOnLogin originating from client sessions.

Detection Strategies

Enable Meteor method-invocation logging and alert on any client-originated calls to the OIDC helper methods listed above.
Audit the Wekan users collection for accounts where isAdmin was set outside of admin console activity.
Correlate organization and team write events against known administrator user IDs and OIDC login timestamps.

Monitoring Recommendations

Forward Wekan application logs and MongoDB audit logs to a central analytics platform for retention and query.
Monitor the state of the PROPAGATE_OIDC_DATA environment variable across deployments, since it materially raises exploit impact.
Track HTTPS and WebSocket traffic to the Wekan DDP endpoint for anomalous method call volumes from single sessions.

How to Mitigate CVE-2026-53444

Immediate Actions Required

Upgrade all Wekan instances to version 9.32 or later, which enforces this.connection === null checks on the affected OIDC methods.
If immediate patching is not possible, unset the PROPAGATE_OIDC_DATA environment variable to eliminate the direct path to global administrator escalation.
Review the users, orgs, and teams collections for unauthorized changes and revoke unexpected administrator rights.

Patch Information

The issue is fixed in Wekan version 9.32. The patch adds a this.connection !== null guard to each affected method, causing direct client DDP calls to be rejected with a not-authorized error while allowing legitimate server-side invocations from the OIDC login flow. See the Wekan v9.32 release and GHSA-cv95-8h7c-2ffq.

Workarounds

Disable the wekan-oidc package on deployments that do not require OIDC single sign-on until the upgrade is applied.
Remove or set PROPAGATE_OIDC_DATA to an empty value to break the group-based administrator promotion path.
Restrict network access to the Wekan DDP endpoint to trusted networks while planning the upgrade.

bash

# Configuration example: remove propagation flag and upgrade
unset PROPAGATE_OIDC_DATA
docker pull quay.io/wekan/wekan:v9.32
docker stop wekan-app && docker rm wekan-app
docker run -d --name wekan-app --env-file /etc/wekan/wekan.env quay.io/wekan/wekan:v9.32