CVE-2026-68561

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.89

Description An improper authorization issue exists in the Boards.allow({ update }) rule within server/permissions/boards.js, which utilizes the canUpdateBoardSort() function in server/lib/utils.js. This allows any board member to be authorized if the fieldNames include sort. Due to the OR semantics used by Meteor when combining allow rules, a member with read-only or comment-only permissions can execute a Boards.update operation using $set values for sort, members, permission, and title. This can enable an attacker to grant themselves sole administrator privileges, expose private boards, and remove the legitimate owner, as the existing deny rule only inspected $pull operations and failed to block a complete $set of members.

Recommendations Update to version 9.89.