CVE-2026-55234

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.37

Description Authenticated users with write access to their own board can move cards, lists, or swimlanes into a private board they are not members of. This occurs because DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and server/permissions/swimlanes.js authorize requests based on the stored source boardId but fail to validate the new boardId provided in the update modifier. The affected API endpoints are '/cards/update', '/lists/update', and '/swimlanes/update'.

Recommendations Update to version 9.37.