CVE-2026-119300 in Wekan
Summary
by MITRE • 10/30/2026
Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. MongoDB-backed deployments evaluate the resulting patterns with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users; searchUsers additionally requires board membership or site-admin status. The FerretDB v1 / RE2 unaffected configuration is not practically affected by catastrophic backtracking. This issue is fixed in version 11.11.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Wekan, an open-source Kanban application built on the Meteor framework, represents a significant security flaw within its user search functionality. Specifically, this issue resides in two components: the user-search publication located at server/publications/users.js and the searchUsers method found in server/models/users.js. The core technical deficiency is that these modules accept authenticated user-controlled inputs for searchTerm and query parameters but fail to properly sanitize or escape regular-expression metacharacters before passing them directly into a new RegExp() constructor. This lack of input validation allows an attacker who has successfully authenticated to the application to inject maliciously crafted strings containing complex regex patterns rather than simple search terms.
From a technical perspective, MongoDB-backed deployments evaluate these resulting regular expression patterns using PCRE2 (Perl Compatible Regular Expressions). While modern systems often utilize RE2 for performance and safety guarantees against catastrophic backtracking, older or specific configurations of Wekan relying on standard Node.js RegExp behavior with MongoDB drivers are susceptible to this class of attack. When a user submits a regex pattern designed to trigger exponential time complexity during evaluation, the system enters a state of catastrophic backtracking. This occurs when the regular expression engine attempts an excessive number of possible matches due to ambiguous quantifiers and nested groups in the crafted input, leading to non-terminating execution loops that consume nearly all available CPU resources on the database server.
The operational impact of this vulnerability is primarily centered around Denial of Service (DoS). Because the searchUsers method requires either board membership or site-administrator status, the attack vector is restricted to authenticated users with at least basic access privileges within a specific board context. However, even limited authentication is sufficient for an attacker to execute the malicious regex payload. The resulting CPU exhaustion on the database server degrades performance for all other active users and can completely deny service by rendering the application unresponsive until the offending process is terminated or the resource limits are reached. It is important to note that deployments utilizing FerretDB version 1 with RE2 support are not practically affected, as RE2 is designed to guarantee linear-time execution on regular expressions, thereby preventing catastrophic backtracking regardless of input complexity.
This vulnerability aligns closely with CWE-400, which covers Uncontrolled Resource Consumption, and specifically relates to the mechanism described in CWE-1335 where an attacker can cause a denial of service through resource exhaustion via regex injection. In terms of the MITRE ATT&CK framework, this behavior corresponds to T1496, Resource Hijacking, as the adversary leverages legitimate application functionality to consume computational resources for disruptive purposes rather than data exfiltration or system compromise. The attack does not typically lead to remote code execution but serves effectively as a disruption tool against multi-tenant environments where resource contention directly impacts service availability.
Mitigation strategies focus on immediate patching and defensive coding practices. The primary remediation is upgrading Wekan to version 11.11 or later, which addresses the flaw by implementing proper input sanitization for regular expression patterns. Developers should ensure that any user-supplied data intended for use in dynamic regex construction is strictly escaped using methods such as RegExp.escape() if available, or manual escaping of special characters like dots, asterisks, plus signs, and parentheses. Additionally, enforcing strict allow-lists on search inputs can prevent the injection of complex pattern syntax entirely. For organizations unable to upgrade immediately, implementing rate limiting on user search endpoints and monitoring for unusual spikes in database CPU usage associated with regex evaluation operations can provide temporary operational resilience against exploitation attempts.