Dashboard / CVE-2026-41454

CVE-2026-41454

HIGH
MEDIUM Priority: 0.02 BB Relevance: 67/100
Published: 2026-04-22 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: High
VI: High
VA: Low

Description

WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification. Attackers can enumerate integrations including webhook URLs, create new integrations, modify or delete existing integrations, and manage integration activities by exploiting insufficient authorization checks in the JsonRoutes REST handlers.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
wekan wekan 0 < 8.35.0

References & Advisories (3)

Bug Bounty Relevance

67 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.7 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.27%
Raw Score 0.002740
Percentile 20.0%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00274
2026-11-12
0.00274
2026-11-10
0.00274
2026-11-09
0.00274
2026-11-08
0.00274

Intelligence Sources

mitre ref →

External Links