Application-layer DoS and Identity Spoofing Vulnerability in Wekan Kanban Board
CVE-2025-65781

8.2HIGH

Key Information:

Vendor

Wekan

Status
Wekan Kanban Board
Vendor
CVE Published:
15 December 2025

What is CVE-2025-65781?

An issue in the Wekan Kanban board system allows for exploitation via its Attachment upload API. When a non-empty Authorization bearer token is provided, the system erroneously treats this value as a user ID. This leads to a non-terminating body-handling branch, enabling attackers to perform application-layer Denial of Service attacks and facilitating identity spoofing. Users on versions up to 18.15 are at risk, with the vulnerability addressed in version 18.16.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/wekan/wekan
https://wekan.fi/hall-of-fame/spacebleed/
https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v81...

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.