Application-layer DoS and Identity Spoofing Vulnerability in Wekan Kanban Board
CVE-2025-65781
Currently unrated
What is CVE-2025-65781?
An issue in the Wekan Kanban board system allows for exploitation via its Attachment upload API. When a non-empty Authorization bearer token is provided, the system erroneously treats this value as a user ID. This leads to a non-terminating body-handling branch, enabling attackers to perform application-layer Denial of Service attacks and facilitating identity spoofing. Users on versions up to 18.15 are at risk, with the vulnerability addressed in version 18.16.