{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-15T17:54:38.833","vulnerabilities":[{"cve":{"id":"CVE-2026-30846","sourceIdentifier":"security-advisories@github.com","published":"2026-03-06T20:16:17.357","lastModified":"2026-03-11T14:24:30.953","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the globalwebhooks publication exposes all global webhook integrations—including sensitive url and token fields—without performing any authentication check on the server side. Although the subscription is normally invoked from the admin settings page, the server-side publication has no access control, meaning any DDP client, including unauthenticated ones, can subscribe and receive the data. This allows an unauthenticated attacker to retrieve global webhook URLs and authentication tokens, potentially enabling unauthorized use of those webhooks and access to connected external services. This issue has been fixed in version 8.34."},{"lang":"es","value":"Wekan es una herramienta kanban de código abierto construida con Meteor. En las versiones 8.31.0 a 8.33, la publicación globalwebhooks expone todas las integraciones de webhook globales —incluyendo campos sensibles de URL y token— sin realizar ninguna comprobación de autenticación en el lado del servidor. Aunque la suscripción se invoca normalmente desde la página de configuración de administrador, la publicación del lado del servidor no tiene control de acceso, lo que significa que cualquier cliente DDP, incluidos los no autenticados, puede suscribirse y recibir los datos. Esto permite a un atacante no autenticado recuperar URLs de webhook globales y tokens de autenticación, lo que podría permitir el uso no autorizado de esos webhooks y el acceso a servicios externos conectados. Este problema ha sido solucionado en la versión 8.34."}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-306"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*","versionStartIncluding":"8.31","versionEndExcluding":"8.33","matchCriteriaId":"82F22D3F-FA6B-485B-94AE-266CD62CC379"}]}]}],"references":[{"url":"https://github.com/wekan/wekan/commit/1ee9b2e917104f54c035f6426169a28fedecbdb6","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/wekan/wekan/releases/tag/v8.34","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://securitylab.github.com/advisories/GHSL-2026-037_Wekan/","source":"security-advisories@github.com","tags":["Third Party Advisory"]}]}}]}