CVE-2026-52892

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.32

Description REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAccess() instead of write-level Authentication.checkBoardWriteAccess() for mutating custom-field routes. This allows a board member with read-only permissions to create, update, or delete board custom fields and dropdown items by calling the /api/boards/:boardId/custom-fields endpoint via POST, PUT, and DELETE methods.

Recommendations Update to version 9.32.