CVE-2026-30845: GHSL-2026-036: Potential Sensitive Token Exposure and Unauthorized Access in Wekan - CVE-2026-30845
The Wekan project version v8.31.0 is affected by a vulnerability (GHSL-2026-036) involving a webhook token leak through the pubsub mechanism, potentially exposing sensitive tokens and enabling unauthorized access or actions.
Other sources
Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the board composite publication in Wekan publishes all integration data for a board without any field filtering, exposing sensitive fields including webhook URLs and authentication tokens to any subscriber. Since board publications are accessible to all board members regardless of their role (including read-only and comment-only users), and even to unauthenticated DDP clients for public boards, any user who can access a board can retrieve its webhook credentials. This token leak allows attackers to make unauthenticated requests to the exposed webhooks, potentially triggering unauthorized actions in connected external services. This issue has been fixed in version 8.34.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30845?
CVE-2026-30845 has a medium severity rating due to its potential exposure of sensitive data.
How do I fix CVE-2026-30845?
To fix CVE-2026-30845, upgrade Wekan to version 8.34 or later, which implements appropriate field filtering.
What are the affected versions of Wekan for CVE-2026-30845?
Wekan versions 8.31.0 through 8.33 are affected by CVE-2026-30845.
What kind of data is exposed due to CVE-2026-30845?
CVE-2026-30845 exposes sensitive integration data through a lack of field filtering during board publication.
Is CVE-2026-30845 a reputable vulnerability?
Yes, CVE-2026-30845 is documented and recognized as a legitimate vulnerability affecting Wekan.