CVE-2026-55652

Katalog CVE

CVSS 9.8 · Critical EPSS 0,62%

Kerentanan Improper Authentication. Skor CVSS 3.1 9.8 (Critical) menurut github.com.

Deskripsi (NVD)

Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js to trust the client-supplied X-Forwarded-For header before the real socket address, allowing an unauthenticated attacker to send HEADER_LOGIN_ID for any username and receive a meteor_login_token session, including for admin. This issue is fixed in version 9.46.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

17 Juli 2026

Status NVD

Deferred

CVSS 3.1

9.8 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/wekan/wekan/commit/b181889a565254bc9bf79379a34fc7f617ccda28
• https://github.com/wekan/wekan/releases/tag/v9.46
• https://github.com/wekan/wekan/security/advisories/GHSA-jggc-qvfc-jr6x