CVE-2026-55652

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.46

Description The header-login feature, when configured with HEADER LOGIN TRUSTED IPS, improperly uses the getRequestIp() function in server/lib/headerLoginAuth.js. This allows the system to trust the client-supplied X-Forwarded-For header over the actual socket address. Consequently, an unauthenticated attacker can provide a HEADER LOGIN ID for any username to obtain a meteor login token session, which can grant unauthorized access to any account, including the administrator.

Recommendations Update to version 9.46. As a temporary mitigation, avoid using the HEADER LOGIN TRUSTED IPS configuration until the update is applied.