CVE-2026-55234 Details

A broken access control vulnerability has been identified in Wekan, an open-source kanban application built with Meteor. This issue affects versions through 9.36. The vulnerability arises because the DDP update allow rules for Cards, Lists, and Swimlanes only verify the current 'boardId' of a document, which reflects the attacker's own board. They do not validate the new 'boardId' being set in the update modifier. As a result, any authenticated user with write access to their own board can manipulate the 'boardId' of cards, lists, or swimlanes, transferring them to a private board they do not belong to. This exploitation bypasses board-level access controls, allowing users to inject arbitrary content into boards they cannot access or read.

Users can update to Wekan version 9.37 or later, where this vulnerability has been fixed.