Wekan up to 9.31 Accounts server/models/users.js onCreateUser improper authentication

Summaryinfo

A vulnerability identified as critical has been detected in Wekan up to 9.31. This vulnerability affects the function onCreateUser of the file server/models/users.js of the component Accounts. Performing a manipulation results in improper authentication. This vulnerability is reported as CVE-2026-52893. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Wekan up to 9.31. It has been classified as critical. This affects the function onCreateUser of the file server/models/users.js of the component Accounts. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking email_verified. An attacker using an OIDC provider account with a victim's email or username can cause Wekan to merge the attacker's OIDC credentials into the victim account and then log in as that account. This issue is fixed in version 9.32.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-52893 since 06/08/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available.

Upgrading to version 9.32 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Wekan

Version

• 9.0
• 9.1
• 9.2
• 9.3
• 9.4
• 9.5
• 9.6
• 9.7
• 9.8
• 9.9
• 9.10
• 9.11
• 9.12
• 9.13
• 9.14
• 9.15
• 9.16
• 9.17
• 9.18
• 9.19
• 9.20
• 9.21
• 9.22
• 9.23
• 9.24
• 9.25
• 9.26
• 9.27
• 9.28
• 9.29
• 9.30
• 9.31

Website

• Product: https://github.com/wekan/wekan/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion