CVE-2026-119300 Details
Description
Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. MongoDB-backed deployments evaluate the resulting patterns with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users; searchUsers additionally requires board membership or site-admin status. The FerretDB v1 / RE2 unaffected configuration is not practically affected by catastrophic backtracking. This issue is fixed in version 11.11.
A denial-of-service vulnerability has been identified in Wekan, an open-source kanban application built with Meteor. This issue affects versions through 11.10 and arises from the user-search publication and the searchUsers method, both of which improperly handle user-provided search terms by passing them to new RegExp() without escaping regular expression metacharacters. In deployments using MongoDB, this oversight allows authenticated users to inject catastrophic-backtracking regular expressions that can significantly degrade database performance, causing service disruptions for other users. The vulnerability is compounded by the fact that the searchUsers method requires board membership or site-admin status.
Users can update to Wekan version 11.11, which addresses this vulnerability by escaping user input before it is passed to RegExp().
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wekan/wekan/security/advisories/GHSA-9846-cj96-6hv5 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/wekan/wekan/commit/4ce5cf6e102854d326e1dcacde6cd20614525dec | [email protected] | Source CodeVendor |
| https://github.com/wekan/wekan/releases/tag/v11.11 | [email protected] | Release NotesVendor |
| https://github.com/wekan/wekan/security/advisories/GHSA-9846-cj96-6hv5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Wekan | <= 11.10 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |