CVE-2026-53444: Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin
Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/oidcserver.js, server/models/org.js, and server/models/team.js are globally callable without the admin authorization checks used by their non-OIDC counterparts. Authenticated users can call setCreateOrgFromOidc, setOrgAllFieldsFromOidc, setCreateTeamFromOidc, setTeamAllFieldsFromOidc, boardRoutineOnLogin, or groupRoutineOnLogin to create or modify organizations and teams, and groupRoutineOnLogin can grant global admin privileges when PROPAGATEOIDCDATA is enabled. This issue is fixed in version 9.32.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wekanto a version that resolves this vulnerability.Fixed in 9.32
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53444?
CVE-2026-53444 has a high severity rating of 7.6.
What is CVE-2026-53444 about?
CVE-2026-53444 details a missing authorization vulnerability in Wekan that allows authenticated users to escalate privileges to admin.
How do I fix CVE-2026-53444?
To resolve CVE-2026-53444, upgrade to Wekan version 9.32 or later, which implements the necessary authorization checks.
What software is affected by CVE-2026-53444?
Wekan versions prior to 9.32 are affected by CVE-2026-53444.
What kind of attack does CVE-2026-53444 enable?
CVE-2026-53444 enables authenticated users to perform privilege escalation attacks by calling OIDC-related Meteor methods without proper authorization.