CVE-2026-41455

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-41455
WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the URL scheme field accepts any string without protocol restriction or destination validation. Attackers who can create or modify integrations can set webhook URLs to internal network addresses, causing the server to issue HTTP POST requests to attacker-controlled internal targets with full board event payloads, and can additionally exploit response handling to overwrite arbitrary comment text without authorization checks.

8.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/wekan/wekan/commit/2cd702f48df2b8aef0e7381685f8e089986a18a4
https://github.com/wekan/wekan/releases/tag/v8.35
https://www.vulncheck.com/advisories/wekan-ssrf-via-webhook-url
Configurations

No configuration.

History

26 May 2026, 14:16

Type Values Removed Values Added
Summary (en) WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the url schema field accepts any string without protocol restriction or destination validation. Attackers who can create or modify integrations can set webhook URLs to internal network addresses, causing the server to issue HTTP POST requests to attacker-controlled internal targets with full board event payloads, and can additionally exploit response handling to overwrite arbitrary comment text without authorization checks. (en) WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the URL scheme field accepts any string without protocol restriction or destination validation. Attackers who can create or modify integrations can set webhook URLs to internal network addresses, causing the server to issue HTTP POST requests to attacker-controlled internal targets with full board event payloads, and can additionally exploit response handling to overwrite arbitrary comment text without authorization checks.

22 Apr 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-22 22:16

Updated : 2026-06-17 10:46

NVD link : CVE-2026-41455

Mitre link : CVE-2026-41455

CVE.ORG link : CVE-2026-41455

JSON object : View

Products Affected

No product.

CWE
CWE-918

Server-Side Request Forgery (SSRF)