cve-2026-119300

MEDIUM CVSS 6.5 gcve_enriched
Description

Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. MongoDB-backed deployments evaluate the resulting patterns with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users; searchUsers additionally requires board membership or site-admin status. The FerretDB v1 / RE2 unaffected configuration is not practically affected by catastrophic backtracking. This issue is fixed in version 11.11.

Timeline
Published
2026-10-30 16:29 UTC
Last Modified
2026-11-04
CVSS Details
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
Affected Products
  • wekan wekan
Weaknesses (CWE)
CWE-1333
SSVC (CISA Stakeholder-Specific Vulnerability Categorization) CISA Coordinator v2.0.3
Exploitation
poc
Automatable
no
Technical Impact
partial
Decision timestamp
2026-11-04T23:00:38.538587Z

What is SSVC? — CISA's vulnerability-prioritisation framework using a decision tree rather than a single score.

References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119300",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T23:00:38.538587Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T23:01:02.327Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/wekan/wekan/security/advisories/GHSA-9846-cj96-6hv5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wekan",
          "vendor": "wekan",
          "versions": [
            {
              "status": "affected",
              "version": "< 11.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. MongoDB-backed deployments evaluate the resulting patterns with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users; searchUsers additionally requires board membership or site-admin status. The FerretDB v1 / RE2 unaffected configuration is not practically affected by catastrophic backtracking. This issue is fixed in version 11.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T16:29:16.786Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/wekan/wekan/security/advisories/GHSA-9846-cj96-6hv5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/wekan/wekan/security/advisories/GHSA-9846-cj96-6hv5"
        },
        {
          "name": "https://github.com/wekan/wekan/commit/4ce5cf6e102854d326e1dcacde6cd20614525dec",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wekan/wekan/commit/4ce5cf6e102854d326e1dcacde6cd20614525dec"
        },
        {
          "name": "https://github.com/wekan/wekan/releases/tag/v11.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wekan/wekan/releases/tag/v11.11"
        }
      ],
      "source": {
        "advisory": "GHSA-9846-cj96-6hv5",
        "discovery": "UNKNOWN"
      },
      "title": "Wekan: ReDoS via Unescaped User Input in RegExp",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "CVE-2026-119300"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119300",
    "datePublished": "2026-10-30T16:29:16.786Z",
    "dateReserved": "2026-10-29T18:50:28.066Z",
    "dateUpdated": "2026-11-04T23:01:02.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-119300",
      "date": "2026-11-04",
      "epss": "0.00295",
      "percentile": "0.22279"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-119300\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-10-30T17:17:18.413\",\"lastModified\":\"2026-11-04T23:17:19.243\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. MongoDB-backed deployments evaluate the resulting patterns with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users; searchUsers additionally requires board membership or site-admin status. The FerretDB v1 / RE2 unaffected configuration is not practically affected by catastrophic backtracking. This issue is fixed in version 11.11.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"wekan\",\"product\":\"wekan\",\"versions\":[{\"version\":\"< 11.11\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-11-04T23:00:38.538587Z\",\"id\":\"CVE-2026-119300\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1333\"}]}],\"references\":[{\"url\":\"https://github.com/wekan/wekan/commit/4ce5cf6e102854d326e1dcacde6cd20614525dec\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/wekan/wekan/releases/tag/v11.11\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/wekan/wekan/security/advisories/GHSA-9846-cj96-6hv5\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/wekan/wekan/security/advisories/GHSA-9846-cj96-6hv5\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Wekan: ReDoS via Unescaped User Input in RegExp\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-1333\", \"lang\": \"en\", \"description\": \"CWE-1333: Inefficient Regular Expression Complexity\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/wekan/wekan/security/advisories/GHSA-9846-cj96-6hv5\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/wekan/wekan/security/advisories/GHSA-9846-cj96-6hv5\"}, {\"name\": \"https://github.com/wekan/wekan/commit/4ce5cf6e102854d326e1dcacde6cd20614525dec\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/wekan/wekan/commit/4ce5cf6e102854d326e1dcacde6cd20614525dec\"}, {\"name\": \"https://github.com/wekan/wekan/releases/tag/v11.11\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/wekan/wekan/releases/tag/v11.11\"}], \"affected\": [{\"vendor\": \"wekan\", \"product\": \"wekan\", \"versions\": [{\"version\": \"< 11.11\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-10-30T16:29:16.786Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. MongoDB-backed deployments evaluate the resulting patterns with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users; searchUsers additionally requires board membership or site-admin status. The FerretDB v1 / RE2 unaffected configuration is not practically affected by catastrophic backtracking. This issue is fixed in version 11.11.\"}], \"source\": {\"advisory\": \"GHSA-9846-cj96-6hv5\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-119300\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-11-04T23:00:38.538587Z\"}}}], \"references\": [{\"url\": \"https://github.com/wekan/wekan/security/advisories/GHSA-9846-cj96-6hv5\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-11-04T23:00:56.118Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-119300\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-10-29T18:50:28.066Z\", \"datePublished\": \"2026-10-30T16:29:16.786Z\", \"dateUpdated\": \"2026-11-04T23:01:02.327Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  },
  "x_gcve": [
    {
      "extensions": {
        "bcp-05-x-01": {
          "ai_annotations": [
            {
              "ai_level": "generated",
              "description": "VLAI severity classification was generated by Vulnerability-Lookup's /vlai/severity-classification API endpoint based on vulnerability description text.",
              "field_name": "x_gcve.extensions.vlai-severity-enrichment",
              "models": [
                {
                  "gna_source": 1,
                  "identifier": "vlai-severity-classification",
                  "name": "VLAI Severity",
                  "provider": "CIRCL",
                  "version": "fc530b2263ef5a89ae4c75ffcbf6b4d878d44b94"
                }
              ],
              "review_status": "none",
              "scope": "field",
              "tags": [
                "ai-computer-assisted:assistance-level=\"ai-generated\"",
                "ai-computer-assisted:review-level=\"unreviewed\""
              ]
            }
          ]
        },
        "vlai-severity-enrichment": {
          "confidence": 0.7419322729110718,
          "generated_at": "2026-11-05T00:25:10+00:00",
          "severity": "Medium",
          "vulnerability_id": "CVE-2026-119300"
        }
      }
    }
  ]
}
Enrichment data
EPSS
View JSON Download
CISA KEV
View JSON Download
GCVE AI Severity
View JSON Download
Aggregated bundle (all enrichments)
View JSON API Download bundle
View JSON API Download JSON