SEPTEMBER 9, 2026
Live Feed
Back to database
Case File

CVE-2026-52893

CRITICAL · CVSS 9.2 EPSS 0.30% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-15 · Last synced 2026-08-14

CyberRota Analysis

AI-Generated

Wekan versions prior to 9.32 are vulnerable due to a flaw in the Accounts.onCreateUser hook, which allows an attacker to merge their OpenID Connect (OIDC) credentials with an existing user account if they possess the same email or username, without proper verification. This vulnerability can lead to unauthorized access to user accounts, potentially compromising sensitive information and user data. Organizations using Wekan should prioritize updating to version 9.32 to mitigate this security risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-52893
Severity
CRITICAL
CVSS
9.2
EPSS
0.30%

Original NVD Description

Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking email_verified. An attacker using an OIDC provider account with a victim's email or username can cause Wekan to merge the attacker's OIDC credentials into the victim account and then log in as that account. This issue is fixed in version 9.32.