CVE-2026-68561

creationtimestamp| type| source ---|---|--- 2026-08-19 21:00:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mthmtiilr52t 2026-08-21 00:00:08+00:00| published-proof-of-concept| Telegram/87w5sTCGBPeMw8h3c2UBbBkEJEqeSW1iUUAENsR3qsz5w...

CVE-2026-68561

Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow update rule in server/permissions/boards.js called canUpdateBoardSort in server/lib/utils.js, which authorized any board member whenever fieldNames included sort. Because Meteor combines allow rules with OR...