CVE-2026-119300

    Dashboard / Vulnerabilities / CVE-2026-119300

    CVE-2026-119300

    Published: 30 Oct 2026Last Modified: 5 Nov 2026

    Summary: Wekan: ReDoS via Unescaped User Input in RegExp

    Details: Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. MongoDB-backed deployments evaluate the resulting patterns with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users; searchUsers additionally requires board membership or site-admin status. The FerretDB v1 / RE2 unaffected configuration is not practically affected by catastrophic backtracking. This issue is fixed in version 11.11.

    References: https://github.com/wekan/wekan/releases/tag/v11.11, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119300.json, https://github.com/wekan/wekan/security/advisories/GHSA-9846-cj96-6hv5, https://nvd.nist.gov/vuln/detail/CVE-2026-119300, https://github.com/wekan/wekan/commit/4ce5cf6e102854d326e1dcacde6cd20614525dec

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -b67b2460181497c116a4c3b183ca0e4a1c42887b

    Affected versions

    v11.10

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119300 | CVE-DB