CVE-2026-68561

🗓️ 19 Aug 2026 19:24:58Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 53 Views🌐 WEB

Wekan 9.89 allows board members to escalate to admin via sort collection-allow rule, exposing private boards.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2026-68561	19 Aug 202621:00	–	circl
Cvelist	CVE-2026-68561 Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule	19 Aug 202619:24	–	cvelist
EUVD	EUVD-2026-62703	19 Aug 202619:24	–	euvd
Mend	CVE-2026-68561	19 Aug 202619:24	–	mend
NVD	CVE-2026-68561	19 Aug 202620:17	–	nvd
Positive Technologies	PT-2026-78651	19 Aug 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-68561: Improper Privilege Management	19 Aug 202600:00	–	rapid7
Vulnrichment	CVE-2026-68561 Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule	19 Aug 202619:24	–	vulnrichment

Vulners

Node

wekan_project wekanRange<9.89

[
  {
    "vendor": "wekan",
    "product": "wekan",
    "versions": [
      {
        "version": "< 9.89",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/wekan/wekan/commit/dc135f6e7d59f9f56065cd5df83b1f123ea120bb
github	www.github.com/wekan/wekan/releases/tag/v9.89
github	www.github.com/wekan/wekan/security/advisories/GHSA-xm8x-c8wg-jhmf

Parameter	Position	Path	Description	CWE
update	request body	/boards	A comment-only or read-only member can use the Boards.update method to modify the 'sort', 'members', 'permission', and 'title' fields via a $set operation, potentially making themselves the sole board administrator.	CWE-269, CWE-863

09 Sep 2026 21:15Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.18.8

EPSS0.00506

SSVC