CVE-2026-119300

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 11.11

Description Authenticated users can cause a denial of service in MongoDB-backed deployments by submitting specially crafted regular expressions. The user-search publication in server/publications/users.js and the searchUsers() method in server/models/users.js pass the searchTerm and query variables to new RegExp() without escaping metacharacters. This allows the use of catastrophic backtracking—a condition where a complex regular expression takes an exponential amount of time to process—which consumes database CPU and degrades service for other users. Access to searchUsers() requires site-admin status or board membership.

Recommendations Update to version 11.11.