CVE-2026-55234Patch

LOWCVSS 8.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Wekan is open source kanban built with Meteor. Prior to 9.37, Wekan DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and server/permissions/swimlanes.js authorize against the stored source boardId and do not validate a new boardId in the update modifier. Any authenticated user with write access to their own board can call /cards/update, /lists/update, or /swimlanes/update to move cards, lists, or swimlanes into a private board they are not a member of. This issue is fixed in version 9.37.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-284CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2026-55234

Full discourse1 post

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters91d
Patch
CVE-2026-55234 - Privilege Escalation in Wekan. Authenticated users can move cards, lists, or swimlanes to private boards they don't have access to. #CVSS 8.5. No patch available. Restrict access immediately. #CVE #Wekan #infosec - https://www.valtersit.com/cve/CVE-2026-55234
Post summary
CVE‑2026‑55234 is a privilege escalation flaw in Wekan with no patch yet; users should immediately restrict access to mitigate the risk.
0000063
982 followersView on X

Explore more

Back to dashboard