CVE-2026-68561: Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule
Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow({ update }) rule in server/permissions/boards.js called canUpdateBoardSort in server/lib/utils.js, which authorized any board member whenever fieldNames included sort. Because Meteor combines allow rules with OR semantics and applies the complete modifier, a comment-only or read-only member could send one Boards.update with $set values for sort, members, permission, and title, make themselves the sole board administrator, expose a private board, and evict the legitimate owner; the last-admin deny rule inspected only $pull and did not block a wholesale $set of members. Version 9.89 requires sort to be the only modified field and rejects $set member arrays that remove the last active administrator. This issue is fixed in version 9.89.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wekan (Meteor app)to a version that resolves this vulnerability.Fixed in 9.89 - Configuration
Upgrade to v9.89, where Boards.update allow logic requires `sort` to be the only modified field and rejects `$set` updates that provide `members` arrays removing the last active administrator.
Wekan (Meteor permissions: server/permissions/boards.js and server/lib/utils.js) Boards.allow({ update }) - sort collection allow rule behavior = sort must be the only modified field; reject $set member arrays that remove the last active administrator
Event History
Frequently Asked Questions
Who can exploit this issue?
Any existing member of a private board, including a comment-only or read-only member, can exploit it. The attacker needs only low-privilege board membership and the ability to send a crafted Boards.update request.
What access could an attacker gain?
An attacker can make themselves the sole board administrator, change the board's visibility or permissions, and remove the legitimate owner. This can expose a private board and give the attacker control over its contents and membership.
Are installations running version 9.89 affected?
No. Version 9.89 fixes the issue by allowing the sort authorization path only when sort is the sole modified field and by rejecting member-array updates that remove the last active administrator.
How can I determine whether a board may have been compromised?
Review board membership, administrator assignments, visibility, permissions, and title changes for unexpected updates. In particular, investigate boards where a low-privilege member became an administrator, other administrators were removed, or a private board became exposed.