CVE-2026-30843

Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 have a critical Insecure Direct Object Reference (IDOR) issue which could allow unauthorized users to modify custom fields across boards through its custom fields update endpoints, potentially leading to unauthorized data manipulation. The PUT /api/boards/:boardId/custom-fields/:customFieldId endpoint in Wekan validates that the authenticated user has access to the specified boardId, but the subsequent database update uses only the custom field's _id as a filter without confirming the field actually belongs to that board. This means an attacker who owns any board can modify custom fields on any other board by supplying a foreign custom field ID, and the same flaw exists in the POST, PUT, and DELETE endpoints for dropdown items under custom fields. The required custom field IDs can be obtained by exporting a board (which only needs read access), since the exported JSON includes the IDs of all board components. The authorization check is performed against the wrong resource, allowing cross-board custom field manipulation. This issue has been fixed in version 8.34.

• CWE-639

• https://github.com/wekan/wekan/commit/73eb98c57afd3d72377a1f7160a52450ab0eeb8bPatch
• https://github.com/wekan/wekan/releases/tag/v8.34Release Notes
• https://securitylab.github.com/advisories/GHSL-2026-044_Wekan/Third Party Advisory

Published

Mar 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30838league/commonmark is a PHP Markdown parser. Prior to version…6.1
• CVE-2026-30839Wallos is an open-source, self-hostable personal subscriptio…4.3
• CVE-2026-3084GStreamer H.266 Codec Parser Integer Underflow Remote Code E…7.8
• CVE-2026-30840Wallos is an open-source, self-hostable personal subscriptio…8.8
• CVE-2026-30841Wallos is an open-source, self-hostable personal subscriptio…6.1
• CVE-2026-30842Wallos is an open-source, self-hostable personal subscriptio…4.3
• CVE-2026-30844Wekan is an open source kanban tool built with Meteor. Versi…8.1
• CVE-2026-30845Wekan is an open source kanban tool built with Meteor. In ve…8.2
• CVE-2026-30846Wekan is an open source kanban tool built with Meteor. In ve…7.5
• CVE-2026-30847Wekan is an open source kanban tool built with Meteor. In ve…6.5
• CVE-2026-30848Parse Server is an open source backend that can be deployed …3.7
• CVE-2026-30849Mantis Bug Tracker (MantisBT) is an open source issue tracke…9.8