---
id: "CVE-2026-119300"
kind: "vulnerability"
aliases: ["CVE-2026-119300"]
title: "Wekan: user search lets a logged-in user stall the database"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["meteor", "mongodb", "package", "self-hosted", "wekan"]
not_affected_if: ["ferretdb-v1-re2", "wekan-11.11-or-later"]
published_at: "2026-10-30T17:17:18+00:00"
first_seen_at: "2026-10-30T17:31:39+00:00"
updated_at: "2026-10-30T17:32:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119300", "first_seen_at": "2026-10-30T17:31:39+00:00"}]
---

# Wekan: user search lets a logged-in user stall the database

Wekan's user-search feature passes user-supplied text straight into regular expressions without escaping, so a crafted search pattern can make MongoDB spend heavy CPU on it. A logged-in user can use this to slow or deny service to other users of the same deployment.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Wekan version and compare it against `11.11`.
- Confirm whether the deployment uses MongoDB; the sources say FerretDB v1 with RE2 is not practically affected.

## Fix

- Wekan: `11.11`

## Timeline

- 2026-10-30T17:31:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119300

## From the sources

Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. MongoDB-backed deployments evaluate the resulting patterns with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users; searchUsers additionally requires board membership or site-admin status. The FerretDB v1 / RE2 unaffected configuration is not practically affected by catastrophic backtracking. This issue is fixed in version 11.11.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_