CVE-2026-53446 Details
Description
Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan webhook integration URLs in models/integrations.js are stored from user input and later fetched by server/notifications/outgoing.js without applying the existing validateAttachmentUrl() private-network checks from models/lib/attachmentUrlValidation.js. A board administrator can configure webhook URLs that cause server-side requests to internal or metadata services. This issue is fixed in version 9.32.
A server-side request forgery (SSRF) vulnerability has been identified in Wekan, an open-source kanban application built with Meteor. This vulnerability exists in versions prior to 9.32. The issue arises because webhook integration URLs are stored from user input without proper validation. These URLs are later fetched by the server, allowing an attacker to send requests to internal services or metadata endpoints. The vulnerability affects board administrators who can configure malicious webhook URLs that trigger server-side requests to private or internal resources.
Users can update to Wekan version 9.32 or later, where this vulnerability has been fixed. Instructions for downloading the latest version are available on the Wekan GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wekan/wekan/commit/0e5fef6f31164fd3de4db353d04173ee0490cd65 | [email protected] | Source CodeVendor |
| https://github.com/wekan/wekan/releases/tag/v9.32 | [email protected] | Release NotesVendor |
| https://github.com/wekan/wekan/security/advisories/GHSA-hc3x-hq3m-663q | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Wekan | <= 8.35 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |