CVE-2026-68561: Wekan Authorization Bypass Vulnerability

CVE-2026-68561 Overview

CVE-2026-68561, also tracked as SortBleed (GHSA-xm8x-c8wg-jhmf), is a privilege escalation vulnerability in Wekan, an open-source kanban board built with Meteor. Versions prior to 9.89 contain a flawed Boards.allow({ update }) rule in server/permissions/boards.js. The canUpdateBoardSort helper in server/lib/utils.js authorized any board member when fieldNames merely included sort. Because Meteor combines allow rules with OR semantics and applies the entire modifier, a low-privilege member could smuggle arbitrary field changes alongside sort and take full control of a board [CWE-269].

Critical Impact
A comment-only or read-only board member can promote themselves to sole administrator, expose a private board, and evict the legitimate owner using a single crafted Boards.update call.

Affected Products

Wekan open-source kanban (Meteor)
All Wekan releases prior to v9.89
Deployments using the Boards.allow sort authorization path

Discovery Timeline

2026-08-19 - CVE-2026-68561 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-68561

Vulnerability Analysis

Wekan relies on Meteor's allow/deny rule engine to authorize client-initiated MongoDB updates against the Boards collection. Two allow rules govern updates: an admin-only rule and a member-only rule intended to permit drag-and-drop reordering of boards. The reordering rule invoked canUpdateBoardSort, which returned true whenever the update touched the sort field and the caller was any board member.

Meteor evaluates allow rules with OR semantics. Once any rule approves, the complete update modifier is applied unless a deny rule rejects it. Meteor does not scope the approving rule to the specific field that satisfied it. This mismatch between per-field intent and whole-modifier application produced the SortBleed condition.

Root Cause

The root cause is improper privilege management [CWE-269] in canUpdateBoardSort. The pre-patch check only verified that sort was among the modified fields, not that it was the sole field. The last-admin deny rule compounded the flaw by inspecting only $pull operations, so a wholesale $set of the members array bypassed the safeguard protecting the final administrator.

Attack Vector

An authenticated attacker with any membership role on a target board issues a single Boards.update containing a $set that includes sort alongside members, permission, and title. The sort allow rule approves the modifier, Meteor applies every field, and the attacker becomes the sole administrator on a now-public board. The legitimate owner is evicted in the same call.

javascript

// Policy: can a user update a board's 'sort' field?
// Requirements:
//  - user must be authenticated
-//  - update must include 'sort' field
+//  - update must touch ONLY the 'sort' field (nothing else)
//  - user must be a member of the board
+//
+// Security (SortBleed, GHSA-xm8x-c8wg-jhmf): this rule is OR'd with the
+// admin-only `allowIsBoardAdmin` update rule (server/permissions/boards.js) so
+// that any board member can drag-reorder boards. Meteor applies the WHOLE
+// modifier once any allow rule approves and no deny rule rejects, and it does
+// NOT scope the approving rule to the field that satisfied it. If this helper
+// merely checked that 'sort' was AMONG the modified fields, a low-privilege
+// (comment-only / read-only) member could smuggle arbitrary board mutations
+// (members, permission, title, ...) into the same $set as sort and take over
+// the board. Requiring 'sort' to be the SOLE modified field means this rule can
+// never approve a modifier that also changes any other field.
export function canUpdateBoardSort(userId, board, fieldNames) {
-  return !!userId && (fieldNames || []).includes('sort') && allowIsBoardMember(userId, board);
+  const fields = fieldNames || [];
+  return !!userId && fields.length === 1 && fields[0] === 'sort' && allowIsBoardMember(userId, board);
}

Source: Wekan Security Patch Commit

Detection Methods for CVE-2026-68561

Indicators of Compromise

Unexpected changes to members, permission, or title on a board coinciding with a sort update in the same modifier.
Board ownership transitions where a previously comment-only or read-only member becomes the sole administrator.
Private boards flipping to public shortly after a low-privilege member interaction.

Detection Strategies

Audit MongoDB update operations against the Boards collection for $set modifiers containing sort combined with any other field.
Correlate Meteor DDP method call logs with membership-role changes to identify smuggled mutations.
Compare board administrator lists over time and alert on last-admin replacements initiated by non-admin accounts.

Monitoring Recommendations

Enable MongoDB profiling or oplog inspection on Wekan deployments to capture multi-field board updates.
Forward application and database telemetry to a centralized data lake for retention and query.
Baseline normal drag-reorder traffic so anomalous multi-field sort updates stand out.

How to Mitigate CVE-2026-68561

Immediate Actions Required

Upgrade Wekan to version 9.89 or later, which enforces that sort is the only modified field.
Review recent board administrator and membership changes to identify possible exploitation.
Restore ownership on any boards where administrator or member arrays were altered without authorization.

Patch Information

The fix is delivered in Wekan v9.89 via commit dc135f6e7d59f9f56065cd5df83b1f123ea120bb. The patch tightens canUpdateBoardSort to require sort as the sole field in the modifier and rejects $set member arrays that would remove the last active administrator. See the Wekan v9.89 Release Notes and the GitHub Security Advisory GHSA-xm8x-c8wg-jhmf.

Workarounds

Restrict Wekan board access to trusted users until upgrade completion.
Temporarily disable client-side drag reordering by removing the Boards.allow sort rule if a hotfix cannot be applied.
Increase monitoring of DDP update traffic to detect multi-field modifiers targeting board documents.

bash

# Configuration example: upgrade Wekan to the patched release
docker pull wekanteam/wekan:v9.89
docker stop wekan-app && docker rm wekan-app
docker run -d --name wekan-app --env-file /etc/wekan/wekan.env -p 3000:8080 wekanteam/wekan:v9.89