Vulnerability Description
WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification. Attackers can enumerate integrations including webhook URLs, create new integrations, modify or delete existing integrations, and manage integration activities by exploiting insufficient authorization checks in the JsonRoutes REST handlers.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/wekan/wekan/commit/2cd702f48df2b8aef0e7381685f8e089986a18a4
- https://github.com/wekan/wekan/releases/tag/v8.35
- https://www.vulncheck.com/advisories/wekan-missing-authorization-via-integration
FAQ
What is CVE-2026-41454?
CVE-2026-41454 is a vulnerability with a CVSS score of 8.3 (HIGH). WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privileg...
How severe is CVE-2026-41454?
CVE-2026-41454 has been rated HIGH with a CVSS base score of 8.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-41454?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.