CVE-2026-55234

HighCVSS 8.5/10Last modified Jul 16, 2026

Description

Wekan is open source kanban built with Meteor. Prior to 9.37, Wekan DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and server/permissions/swimlanes.js authorize against the stored source boardId and do not validate a new boardId in the update modifier. Any authenticated user with write access to their own board can call /cards/update, /lists/update, or /swimlanes/update to move cards, lists, or swimlanes into a private board they are not a member of. This issue is fixed in version 9.37.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

Weakness enumeration

CWE-284 CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Jul 15, 2026
Last modified: Jul 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-552355.9langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specif CVE-2026-552365.9langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorize CVE-2026-552378.8AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions prior to CVE-2026-552385.3xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, wh CVE-2026-552398.8Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/serv CVE-2026-55249.8The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and CVE-2026-552409.1Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/temp CVE-2026-552417.5Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-t CVE-2026-552428.8ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard op CVE-2026-552445.0ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in asteval/astutils.py exposes BaseException, SystemEx CVE-2026-552458.7Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/util CVE-2026-552467.8bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie_init_file() in bincookie.h allocates a buffer using the actual .b