Authorization Vulnerability in WeKan by WeKan Team
CVE-2026-25565

7.1HIGH

Key Information:

Vendor

Wekan

Status
Wekan
Vendor
CVE Published:
7 February 2026

What is CVE-2026-25565?

WeKan versions prior to 8.19 have a significant authorization vulnerability where certain card update API paths are improperly validated. These paths check only for board read access instead of enforcing the necessary write permissions. This oversight permits users with read-only roles to execute card updates, which should be restricted to users with write access. As a result, unauthorized modifications can occur, potentially compromising the integrity of the board. It is advised to update to the latest version to mitigate this vulnerability.

Affected Version(s)

WeKan 0 < 8.19

References

https://github.com/wekan/wekan/commit/181f837d8cbae96bdf9...
patch
https://wekan.fi/
product
https://www.vulncheck.com/advisories/wekan-read-only-boar...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers
.