{"id":"CVE-2026-119300","kind":"vulnerability","aliases":["CVE-2026-119300"],"related":[],"title":"Wekan: user search lets a logged-in user stall the database","description":"Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. MongoDB-backed deployments evaluate the resulting patterns with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users; searchUsers additionally requires board membership or site-admin status. The FerretDB v1 / RE2 unaffected configuration is not practically affected by catastrophic backtracking. This issue is fixed in version 11.11.","summary":"Wekan's user-search feature passes user-supplied text straight into regular expressions without escaping, so a crafted search pattern can make MongoDB spend heavy CPU on it. A logged-in user can use this to slow or deny service to other users of the same deployment.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["meteor","mongodb","package","self-hosted","wekan"],"not_affected_if":["ferretdb-v1-re2","wekan-11.11-or-later"],"how_to_check":"- Check the installed Wekan version and compare it against `11.11`.\n- Confirm whether the deployment uses MongoDB; the sources say FerretDB v1 with RE2 is not practically affected.","fix":"- Wekan: `11.11`","status":"open","published_at":"2026-10-30T17:17:18+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","triaged_at":"2026-10-30T17:32:06+00:00","updated_at":"2026-10-30T17:32:06+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T17:32:06Z","model":"claude-haiku-5-5","output":{"fix":"- Wekan: `11.11`","reach":"network","title":"Wekan: user search lets a logged-in user stall the database","impact":"low","summary":"Wekan's user-search feature passes user-supplied text straight into regular expressions without escaping, so a crafted search pattern can make MongoDB spend heavy CPU on it. A logged-in user can use this to slow or deny service to other users of the same deployment.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wekan","self-hosted","mongodb","meteor"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Logged-in user degrades database performance and denies service to others","analyst_note":"","how_to_check":"- Check the installed Wekan version and compare it against `11.11`.\n- Confirm whether the deployment uses MongoDB; the sources say FerretDB v1 with RE2 is not practically affected.","plain_action":"","needs_analyst":false,"not_affected_if":["ferretdb-v1-re2","wekan-11.11-or-later"],"who_is_affected":"Self-hosted Wekan instances running before 11.11 on MongoDB are exposed, because any logged-in user can trigger the expensive search. Deployments on FerretDB v1 (RE2 regex engine) are not practically affected by catastrophic backtracking, according to the sources. Exploitation of the searchUsers path additionally needs board membership or site-admin status.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000695,"input_tokens":4247,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119300':15A,18A '-2026':14A,17A '11.11':86C,181C 'addit':153C 'admin':160C 'affect':171C 'allow':128C 'authent':101C 'back':120C 'backtrack':138C,174C 'board':155C 'built':81C 'catastroph':137C,173C 'catastrophic-backtrack':136C 'configur':167C 'consum':141C 'control':104C 'cpu':53B,143C 'craft':45B 'cve':13A,16A 'databas':12A,142C 'degrad':145C 'deni':67B,147C 'deploy':75B,121C 'escap':42B,113C 'evalu':122C 'express':40B,116C,139C 'featur':31B 'ferretdb':163C 'fix':178C 'heavi':52B 'host':24B 'issu':176C 'kanban':80C 'let':4A 'log':7A,58B,131C 'logged-in':6A,57B,130C 'make':49B 'membership':156C 'metacharact':117C 'meteor':19B,83C 'method':97C 'mongodb':20B,50B,119C 'mongodb-back':118C 'new':110C 'open':78C 'packag':21B 'pass':32B,100C 'pattern':47B,125C 'pcre2':127C 'practic':170C 'prior':84C 'public':91C 'queri':107C 're2':165C 'regexp':111C 'regular':39B,115C 'regular-express':114C 'requir':154C 'result':124C 'search':3A,30B,46B,90C 'searchterm':105C 'searchus':96C,152C 'self':23B 'self-host':22B 'server/models/users.js':99C 'server/publications/users.js':93C 'servic':68B,148C 'site':159C 'site-admin':158C 'slow':65B 'sourc':79C 'spend':51B 'stall':10A 'status':161C 'straight':37B 'submit':135C 'suppli':35B 'text':36B 'unaffect':166C 'use':62B 'user':2A,9A,29B,34B,60B,71B,89C,103C,133C,151C 'user-control':102C 'user-search':28B,88C 'user-suppli':33B 'v1':164C 'valu':108C 'version':180C 'wekan':1A,25B,26B,76C 'without':41B,112C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Wekan instances running before 11.11 on MongoDB are exposed, because any logged-in user can trigger the expensive search. Deployments on FerretDB v1 (RE2 regex engine) are not practically affected by catastrophic backtracking, according to the sources. Exploitation of the searchUsers path additionally needs board membership or site-admin status.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T17:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119300","severity":null,"published_at":"2026-10-30T17:17:18+00:00","modified_at":"2026-10-30T17:17:18+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","fetched_at":"2026-10-30T17:31:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}