Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication

The primary impact of CVE-2026-30846 is the exposure of sensitive webhook integration data. Attackers can exploit this vulnerability to gain unauthorized access to systems and services integrated with Wekan webhooks. This could lead to data breaches, unauthorized actions, and potential compromise of connected applications. The lack of authentication checks on the server-side publication makes this vulnerability particularly concerning, as any DDP client can subscribe and retrieve the data. This is similar to other DDP-related vulnerabilities where improper access controls lead to data leakage.

Organizations using Wekan for project management and task tracking, particularly those relying on webhooks for integration with other systems, are at risk. This includes teams using Wekan in shared hosting environments or with legacy configurations that may not have robust network security controls.

• nodejs / server:

# Check for Wekan version
npm list -g wekan

• nodejs / server:

# Monitor DDP traffic for unauthorized subscriptions to globalwebhooks
# (Requires DDP monitoring tools)

• generic web:

# Check Wekan instance for exposed DDP endpoints
curl -I http://your-wekan-instance/api/v1/public/globalwebhooks

1. 2026-03-06Disclosure

   disclosure

1. Reserviert2026-03-05
2. Veröffentlicht2026-03-06
3. Geändert2026-03-09
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-30846 is to upgrade Wekan to version 8.34 or later, which includes the necessary access control fixes. If upgrading immediately is not possible, consider implementing temporary workarounds such as restricting network access to the Wekan instance and monitoring webhook activity for suspicious behavior. While a WAF or proxy cannot directly prevent the vulnerability, it can help detect and block malicious requests attempting to exploit it. After upgrading, confirm the fix by attempting to subscribe to the globalwebhooks publication with an unauthenticated DDP client and verifying that access is denied.