CVE-2026-119300

MEDIUM 6.5

Wekan: ReDoS via Unescaped User Input in RegExp

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. MongoDB-backed deployments evaluate the resulting patterns with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users; searchUsers additionally requires board membership or site-admin status. The FerretDB v1 / RE2 unaffected configuration is not practically affected by catastrophic backtracking. This issue is fixed in version 11.11.

CWE	CWE-1333
Vendor	wekan
Product	wekan
Published	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for wekan wekan

Be the first to know when new medium vulnerabilities affecting wekan wekan are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

wekan / wekan

< 11.11

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/wekan/wekan/security/advisories/GHSA-9846-cj96-6hv5 github.com: https://github.com/wekan/wekan/commit/4ce5cf6e102854d326e1dcacde6cd20614525dec github.com: https://github.com/wekan/wekan/releases/tag/v11.11