CVE-2026-59154 Details

A cross-board authorization bypass vulnerability has been identified in Wekan, an open-source kanban application built with Meteor. This issue affects versions prior to 9.64 and allows low-privileged authenticated users with write access to one board to manipulate checklist data on private cards in boards where they are not members. The vulnerability arises because the direct Meteor collection allow rules for Checklists and ChecklistItems only authorize updates based on the current source card ID, without considering the destination card ID or board ID. As a result, an attacker can create or modify checklist items on accessible cards and transfer them to private boards, bypassing authorization controls.

Users are advised to update to Wekan version 9.64, where this vulnerability has been fixed. Instructions for downloading the latest version can be found on the Wekan GitHub Releases page.