https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T18:39:34.547849+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-52892 CVE-2026-52892 — Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on wri… 2026-10-07T18:39:34.549749+00:00

Affected: wekan

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAccess instead of write-level Authentication.checkBoardWriteAccess for mutating custom-field routes. A read-only board member can call POST, PUT, and DELETE handlers for /api/boards/:boardId/custom-fields and custom-field dropdown items to create, update, or delete board custom fields. This issue is fixed in version 9.32.