Description
Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the notificationUsers publication in Wekan publishes user documents with no field filtering, causing the ReactiveCache.getUsers() call to return all fields including highly sensitive data such as bcrypt password hashes, active session login tokens, email verification tokens, full email addresses, and any stored OAuth tokens. Unlike Meteor's default auto-publication which strips the services field for security, custom publications return whatever fields the cursor contains, meaning all subscribers receive the complete user documents. Any authenticated user who triggers this publication can harvest credentials and active session tokens for other users, enabling password cracking, session hijacking, and full account takeover. This issue has been fixed in version 8.34.
EPSS Score:
0%
Comprehensive Technical Analysis of EUVD-2026-10066
1. Vulnerability Assessment and Severity Evaluation
The vulnerability described in EUVD-2026-10066 affects Wekan, an open-source kanban tool built with Meteor. Specifically, versions 8.31.0 through 8.33 are impacted by a flaw in the notificationUsers publication, which publishes user documents without field filtering. This results in the ReactiveCache.getUsers() call returning highly sensitive data, including bcrypt password hashes, active session login tokens, email verification tokens, full email addresses, and stored OAuth tokens.
Severity Evaluation:
- Base Score: 9.3 (CVSS 4.0)
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:H
The high base score indicates a critical vulnerability due to the potential for significant impact on confidentiality, integrity, and availability. The attack complexity is low, and the attack vector is network-based, requiring low privileges and no user interaction.
2. Potential Attack Vectors and Exploitation Methods
Attack Vectors:
- Authenticated User Access: Any authenticated user can trigger the
notificationUserspublication, leading to the exposure of sensitive user data. - Data Harvesting: An attacker can harvest credentials and active session tokens, enabling further attacks such as password cracking, session hijacking, and full account takeover.
Exploitation Methods:
- Password Cracking: Using the exposed bcrypt password hashes, an attacker can attempt to crack passwords offline.
- Session Hijacking: With access to active session login tokens, an attacker can hijack user sessions and perform actions on behalf of the user.
- Account Takeover: By exploiting the exposed OAuth tokens and email verification tokens, an attacker can take full control of user accounts.
3. Affected Systems and Software Versions
Affected Versions:
- Wekan versions 8.31.0 through 8.33
Fixed Version:
- Wekan version 8.34
4. Recommended Mitigation Strategies
Immediate Actions:
- Upgrade: Upgrade to Wekan version 8.34 or later, which includes the fix for this vulnerability.
- Access Control: Implement strict access controls to limit the number of authenticated users who can trigger the
notificationUserspublication. - Monitoring: Increase monitoring for unusual activity, especially around user authentication and session management.
Long-Term Strategies:
- Code Review: Conduct thorough code reviews to ensure proper field filtering in custom publications.
- Security Training: Provide security training for developers to understand the risks associated with custom publications in Meteor.
- Regular Updates: Ensure regular updates and patches are applied to all software components.
5. Impact on European Cybersecurity Landscape
The vulnerability poses a significant risk to organizations using Wekan within the European Union, particularly those handling sensitive data. The exposure of user credentials and tokens can lead to data breaches, unauthorized access, and potential violations of data protection regulations such as GDPR. Organizations must prioritize patching and implementing robust security measures to mitigate these risks.
6. Technical Details for Security Professionals
Technical Overview:
- Vulnerable Component:
notificationUserspublication in Wekan - Impacted Data: bcrypt password hashes, active session login tokens, email verification tokens, full email addresses, stored OAuth tokens
- Root Cause: Lack of field filtering in the custom publication, leading to the exposure of complete user documents
Detection and Response:
- Log Analysis: Review logs for unusual access patterns and data retrieval requests.
- Intrusion Detection: Implement intrusion detection systems (IDS) to monitor for unauthorized access attempts.
- Incident Response: Develop an incident response plan to address potential data breaches and account takeovers.
References:
By addressing this vulnerability promptly and implementing robust security measures, organizations can significantly reduce the risk of data breaches and ensure the integrity and confidentiality of user data.