CVE-2026-77170

CVE-2026-77170 affects the Deck config API , where an insufficient authorization check allows any authenticated user to set board-scoped configuration keys for arbitrary board IDs without verifying ownership or management permission over the referenced board. The impact is rated MEDIUM (CVSS 3.0:...

PT-2026-78651

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.89 Description An improper authorization issue exists in the Boards.allow update rule within server/permissions/boards.js, which utilizes the canUpdateBoardSort function in server/lib/utils.js. This allows any board...