CVE-2026-30846: Information Disclosure in Wekan Kanban Tool

The primary impact of CVE-2026-30846 is the exposure of sensitive webhook integration data. Attackers can exploit this vulnerability to gain unauthorized access to systems and services integrated with Wekan webhooks. This could lead to data breaches, unauthorized actions, and potential compromise of connected applications. The lack of authentication checks on the server-side publication makes this vulnerability particularly concerning, as any DDP client can subscribe and retrieve the data. This is similar to other DDP-related vulnerabilities where improper access controls lead to data leakage.

1. Reserved2026-03-05
2. Published2026-03-06
3. Modified2026-03-09
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-30846 is to upgrade Wekan to version 8.34 or later, which includes the necessary access control fixes. If upgrading immediately is not possible, consider implementing temporary workarounds such as restricting network access to the Wekan instance and monitoring webhook activity for suspicious behavior. While a WAF or proxy cannot directly prevent the vulnerability, it can help detect and block malicious requests attempting to exploit it. After upgrading, confirm the fix by attempting to subscribe to the globalwebhooks publication with an unauthenticated DDP client and verifying that access is denied.