CVE-2026-25560 in WeKan
Summary
by MITRE • 02/08/2026
WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporated into LDAP search filters and DN-related values without adequate escaping, allowing an attacker to manipulate LDAP queries during authentication.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/16/2026
The vulnerability identified as CVE-2026-25560 represents a critical LDAP filter injection flaw within the WeKan authentication system affecting versions prior to 8.19. This issue stems from insufficient input sanitization mechanisms that fail to properly escape user-supplied credentials during the LDAP authentication process. The flaw allows malicious actors to manipulate the underlying LDAP search filters and distinguished name constructions, potentially enabling unauthorized access to the system.
The technical implementation of this vulnerability occurs when WeKan processes user authentication requests through LDAP integration. When a user attempts to log in, the system incorporates the provided username directly into LDAP search filter constructions without appropriate escaping or sanitization. This creates an environment where attackers can inject malicious LDAP filter syntax into the authentication flow, potentially bypassing normal access controls and gaining unauthorized system access.
From an operational impact perspective, this vulnerability exposes WeKan installations to significant security risks including unauthorized authentication, privilege escalation, and potential data compromise. Attackers could exploit this flaw to enumerate valid users within the LDAP directory, bypass authentication mechanisms entirely, or gain access to restricted system resources. The vulnerability particularly affects organizations relying on LDAP-based authentication for their WeKan deployments, creating a substantial attack surface that could lead to full system compromise.
The vulnerability aligns with CWE-77 and CWE-94 categories within the Common Weakness Enumeration framework, specifically addressing improper neutralization of special elements used in LDAP queries and injection flaws in authentication systems. From the MITRE ATT&CK framework perspective, this vulnerability maps to techniques involving credential access through authentication bypass and privilege escalation, potentially enabling lateral movement within networks where WeKan is deployed.
Organizations should immediately upgrade to WeKan version 8.19 or later to address this vulnerability. Additional mitigations include implementing strict input validation for authentication endpoints, enabling comprehensive logging and monitoring of authentication attempts, and conducting regular security assessments of LDAP integration points. Network segmentation and access controls should be reinforced to limit potential exploitation impact, while security teams should monitor for indicators of compromise related to unauthorized authentication attempts or unusual LDAP query patterns.