Technical impact
Wekan is a Meteor‑based open‑source Kanban platform. In versions before 9.32, the OIDC‑related Meteor methods defined in packages/wekan-oidc/oidc_server.js, server/models/org.js, and server/models/team.js can be invoked by any authenticated user because they lack the admin authorization checks that the non‑OIDC methods enforce. The exposed methods—including setCreateOrgFromOidc, setOrgAllFieldsFromOidc, setCreateTeamFromOidc, setTeamAllFieldsFromOidc, boardRoutineOnLogin, and groupRoutineOnLogin—allow users to create or modify organizations and teams. When server configuration permits PROPAGATE_OIDC_DATA, groupRoutineOnLogin can bestow global administrator rights on the caller. The vulnerability maps to CWE‑269 (Least Privilege) and CWE‑862 (Missing Authorization) and provides a clear path for privilege escalation to full admin control, but does not enable code execution or denial of service. This issue is fixed in version 9.32.
Affected Systems
The vulnerability affects every installation of the wekan:wekan package that is running any version prior to 9.32. It is not limited to a geographic region or deployment environment; any instance that uses any of the files in packages/wekan-oidc/oidc_server.js, server/models/org.js, or server/models/team.js within those pre‑9.32 releases is susceptible.
Risk and Exploitability
The base CVSS score of 7.6 classifies the issue as High severity. The EPSS score of less than 1 % indicates that publicly available exploitation is unlikely at the moment, and the vulnerability is not included in CISA’s KEV catalog. Nonetheless, the flaw allows a legitimately authenticated attacker—who can log in via an OIDC provider or possess any existing account—to invoke the vulnerable methods and obtain full system‑wide administrative control, enabling data exfiltration, modification, or denial of service. The most feasible attack vector is an authenticated user who can call the OIDC methods after log‑in; the vulnerability requires no privileged user level to exploit.
