CVE-2026-30847

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30847", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-05T21:27:35.341Z", "datePublished": "2026-03-06T19:37:19.337Z", "dateUpdated": "2026-03-09T20:34:19.842Z"}, "containers": {"cna": {"title": "Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:H", "version": "4.0"}}], "references": [{"name": "https://securitylab.github.com/advisories/GHSL-2026-035_Wekan/", "tags": ["x_refsource_CONFIRM"], "url": "https://securitylab.github.com/advisories/GHSL-2026-035_Wekan/"}, {"name": "https://github.com/wekan/wekan/commit/1c8667eae8b28739e43569b612ffdb2693c6b1ce", "tags": ["x_refsource_MISC"], "url": "https://github.com/wekan/wekan/commit/1c8667eae8b28739e43569b612ffdb2693c6b1ce"}, {"name": "https://github.com/wekan/wekan/releases/tag/v8.34", "tags": ["x_refsource_MISC"], "url": "https://github.com/wekan/wekan/releases/tag/v8.34"}], "affected": [{"vendor": "Wekan", "product": "Wekan", "versions": [{"version": ">= 8.31.0, < 8.34", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T19:37:19.337Z"}, "descriptions": [{"lang": "en", "value": "Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the notificationUsers publication in Wekan publishes user documents with no field filtering, causing the ReactiveCache.getUsers() call to return all fields including highly sensitive data such as bcrypt password hashes, active session login tokens, email verification tokens, full email addresses, and any stored OAuth tokens. Unlike Meteor's default auto-publication which strips the services field for security, custom publications return whatever fields the cursor contains, meaning all subscribers receive the complete user documents. Any authenticated user who triggers this publication can harvest credentials and active session tokens for other users, enabling password cracking, session hijacking, and full account takeover. This issue has been fixed in version 8.34."}], "source": {"advisory": "GHSA-q83p-q5qr-cm7g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30847", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T20:24:37.252518Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:34:19.842Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30847", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-05T21:27:35.341Z", "datePublished": "2026-03-06T19:37:19.337Z", "dateUpdated": "2026-03-06T19:37:19.337Z"}, "containers": {"cna": {"title": "Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:H", "version": "4.0"}}], "references": [{"name": "https://securitylab.github.com/advisories/GHSL-2026-035_Wekan/", "tags": ["x_refsource_CONFIRM"], "url": "https://securitylab.github.com/advisories/GHSL-2026-035_Wekan/"}, {"name": "https://github.com/wekan/wekan/commit/1c8667eae8b28739e43569b612ffdb2693c6b1ce", "tags": ["x_refsource_MISC"], "url": "https://github.com/wekan/wekan/commit/1c8667eae8b28739e43569b612ffdb2693c6b1ce"}, {"name": "https://github.com/wekan/wekan/releases/tag/v8.34", "tags": ["x_refsource_MISC"], "url": "https://github.com/wekan/wekan/releases/tag/v8.34"}], "affected": [{"vendor": "Wekan", "product": "Wekan", "versions": [{"version": ">= 8.31.0, < 8.34", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T19:37:19.337Z"}, "descriptions": [{"lang": "en", "value": "Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the notificationUsers publication in Wekan publishes user documents with no field filtering, causing the ReactiveCache.getUsers() call to return all fields including highly sensitive data such as bcrypt password hashes, active session login tokens, email verification tokens, full email addresses, and any stored OAuth tokens. Unlike Meteor's default auto-publication which strips the services field for security, custom publications return whatever fields the cursor contains, meaning all subscribers receive the complete user documents. Any authenticated user who triggers this publication can harvest credentials and active session tokens for other users, enabling password cracking, session hijacking, and full account takeover. This issue has been fixed in version 8.34."}], "source": {"advisory": "GHSA-q83p-q5qr-cm7g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30847", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T20:24:37.252518Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-09T20:26:55.584Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"affected": [{"affectedData": [{"product": "Wekan", "vendor": "Wekan", "versions": [{"status": "affected", "version": ">= 8.31.0, < 8.34"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*", "matchCriteriaId": "82F22D3F-FA6B-485B-94AE-266CD62CC379", "versionEndExcluding": "8.33", "versionStartIncluding": "8.31", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the notificationUsers publication in Wekan publishes user documents with no field filtering, causing the ReactiveCache.getUsers() call to return all fields including highly sensitive data such as bcrypt password hashes, active session login tokens, email verification tokens, full email addresses, and any stored OAuth tokens. Unlike Meteor's default auto-publication which strips the services field for security, custom publications return whatever fields the cursor contains, meaning all subscribers receive the complete user documents. Any authenticated user who triggers this publication can harvest credentials and active session tokens for other users, enabling password cracking, session hijacking, and full account takeover. This issue has been fixed in version 8.34."}, {"lang": "es", "value": "Wekan es una herramienta kanban de c\u00f3digo abierto construida con Meteor. En las versiones 8.31.0 a la 8.33, la publicaci\u00f3n notificationUsers en Wekan publica documentos de usuario sin filtrar campos, lo que provoca que la llamada a ReactiveCache.getUsers() devuelva todos los campos, incluyendo datos altamente sensibles como hashes de contrase\u00f1a bcrypt, tokens de inicio de sesi\u00f3n de sesi\u00f3n activa, tokens de verificaci\u00f3n de correo electr\u00f3nico, direcciones de correo electr\u00f3nico completas y cualquier token OAuth almacenado. A diferencia de la auto-publicaci\u00f3n predeterminada de Meteor, que elimina el campo services por seguridad, las publicaciones personalizadas devuelven todos los campos que contiene el cursor, lo que significa que todos los suscriptores reciben los documentos de usuario completos. Cualquier usuario autenticado que active esta publicaci\u00f3n puede recolectar credenciales y tokens de sesi\u00f3n activa de otros usuarios, lo que permite el cracking de contrase\u00f1as, el secuestro de sesi\u00f3n y la toma de control total de la cuenta. Este problema ha sido solucionado en la versi\u00f3n 8.34."}], "id": "CVE-2026-30847", "lastModified": "2026-06-17T10:33:01.473", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30847", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T20:24:37.252518Z", "version": "2.0.3"}}]}, "published": "2026-03-06T20:16:17.530", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/wekan/wekan/commit/1c8667eae8b28739e43569b612ffdb2693c6b1ce"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/wekan/wekan/releases/tag/v8.34"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://securitylab.github.com/advisories/GHSL-2026-035_Wekan/"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-285"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.31.0,8.34)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Wekan", "source": "cna", "vendor": "Wekan"}, "product": "wekan", "vendor": "wekan"}], "analysis": {"en": {"generated_at": "2026-04-16T11:14:39.828719+00:00", "value": {"mitigation_remediation": ["Upgrade Wekan to version 8.34 or later to apply the publisher filter fix", "Revise or disable the custom notificationUsers publication to restrict exposed fields", "Force affected users to re\u2011authenticate or reset passwords to invalidate stolen session tokens"], "summary": {"action": "Immediate Patch", "impact": "Compromise of Credentials"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the open\u2011source kanban tool Wekan, specifically versions 8.31.0 to 8.33. The issue is present in all installations running those releases and is resolved in version 8.34 or later.", "description_and_impact": "Wekan versions 8.31.0 through 8.33 expose all user fields through the notificationUsers publication. Because no filtering is applied, subscribers receive sensitive data such as bcrypt password hashes, session tokens, email verification tokens, full email addresses, and OAuth tokens. The weakness corresponds to information disclosure (CWE\u2011200) and improper authorization (CWE\u2011285). An attacker can harvest this data and use it for password cracking, session hijacking, and full account takeover, jeopardizing confidentiality and integrity of all affected accounts.", "risk_and_exploitability": "The CVSS score of 9.3 indicates critical severity, and the EPSS score of less than 1% suggests low current exploit probability. The vulnerability is not listed in CISA\u2019s KEV catalog. The attack requires an authenticated user to trigger the notificationUsers publication; any such user can harvest credentials of all other users. The lack of field filtering in the publication allows the entire user document to be exposed, making remediation urgent."}}}}, "created": "2026-03-09T10:07:05.274557+00:00", "updated": "2026-04-16T11:15:27.693931+00:00", "vendors": ["wekan", "wekan$PRODUCT$wekan"]}