CVE-2026-119300

Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. MongoDB-backed deployments evaluate the resulting patterns with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users; searchUsers additionally requires board membership or site-admin status. The FerretDB v1 / RE2 unaffected configuration is not practically affected by catastrophic backtracking. This issue is fixed in version 11.11.

• CWE-1333

• https://github.com/wekan/wekan/commit/4ce5cf6e102854d326e1dcacde6cd20614525dec
• https://github.com/wekan/wekan/releases/tag/v11.11
• https://github.com/wekan/wekan/security/advisories/GHSA-9846-cj96-6hv5

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-119290Zuke is a code-first, strongly typed build automation system…7.5
• CVE-2026-119291Zuke is a code-first, strongly typed build automation system…5.5
• CVE-2026-119298croc is a tool that allows any two computers to simply and s…4.2
• CVE-2026-119299gopacket provides packet processing capabilities for Go. Pri…5.9
• CVE-2026-1193A vulnerability was identified in MineAdmin 1.x/2.x. The imp…8.8
• CVE-2026-11930IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Ver…7.5
• CVE-2026-11931Incorrect default permissions in Kiro IDE on macOS and Linux…5.5
• CVE-2026-119317On Linux, an authenticated, low-privileged Nessus user with …6.5
• CVE-2026-11932IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Ver…7.5
• CVE-2026-119325Bricks Theme 2.4 and before for WordPress contains an unauth…7.5
• CVE-2026-11933A use-after-free vulnerability exists in MongoDB Server's se…8.8
• CVE-2026-11934IBM Verify Identity Access could allow an administrator to e…7.2