Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAccess instead of write-level Authentication.checkBoardWriteAccess for mutating custom-field routes. A read-only board member can call POST, PUT, and DELETE handlers for /api/boards/:boardId/custom-fields and custom-field dropdown items to create, update, or delete board custom fields. This issue is fixed in version 9.32.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-52892 Authentication Bypass in Wekan Prior to 9.32 Allows Custom Field Manipulation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-52892
Post summary
The post reports a newly discovered authentication bypass vulnerability in Wekan prior to version 9.32 that permits custom field manipulation, but it does not mention any Proof of Concept, exploit tools, active exploitation, or available fixes.