Wekan versions before 8.35 have critical security vulnerabilities that allow unauthorized administrative actions and server-side request forgery.

🟠 CVE-2026-41454 - High (8.3) WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification. Attackers can enumerate integr... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41454/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41455 - High (8.5) WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the url schema field accepts any string without protocol restriction or destination validation. Attackers who can create or modify in... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41455/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 EUVD-2026-25117 📊 Score: 8.7/10 (CVSS v3.1) 📦 Product: Wekan, Wekan 🏢 Vendor: WeKan 📅 Updated: 2026-04-22 📝 WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification. Attackers can enumerate integrations in... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25117 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-25118 📊 Score: 6.3/10 (CVSS v3.1) 📦 Product: Wekan, Wekan 🏢 Vendor: WeKan 📅 Updated: 2026-04-22 📝 WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the url schema field accepts any string without protocol restriction or destination validation. Attackers who can create or modify integration... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25118 #cybersecurity #infosec #euvd #cve #vulnerability