CVE-2026-25562 in WeKan
Summary
by MITRE • 02/08/2026
WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication. Attachment metadata can be returned without properly scoping results to boards and cards accessible to the requesting user, potentially exposing attachment metadata to unauthorized users.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/16/2026
The vulnerability identified as CVE-2026-25562 affects WeKan versions prior to 8.19 and represents a critical information disclosure flaw within the application's attachment publication mechanism. This vulnerability stems from insufficient access control implementation when returning attachment metadata, creating a scenario where unauthorized users can potentially access sensitive information that should be restricted to specific boards and cards within the application's permission model.
The technical flaw manifests in the attachment metadata retrieval process where the system fails to properly scope query results based on user permissions and board access controls. When a user requests attachment information, the application should validate that the requesting user has appropriate access rights to the specific board and card containing the attachment before returning any metadata. However, the vulnerability allows for metadata to be exposed regardless of these access restrictions, effectively bypassing the application's intended security boundaries.
This information disclosure vulnerability operates under the CWE-200 category of "Information Exposure" and aligns with ATT&CK technique T1213.001 "Data from Information Repositories" as it enables unauthorized access to data stored within the application's repository. The operational impact is significant as compromised attachment metadata could reveal sensitive information including file names, sizes, upload timestamps, and potentially file content details that may contain confidential data. Attackers could exploit this vulnerability to gain insights into project timelines, document structures, and potentially identify other security weaknesses within the application's data handling processes.
The vulnerability affects the core access control mechanisms that protect user data within WeKan's collaborative environment, where boards and cards represent different levels of project organization and information sensitivity. When unauthorized users can access attachment metadata from boards and cards they should not have access to, it creates a cascading effect that undermines the entire permission model and could lead to further exploitation opportunities. Organizations using WeKan in environments with sensitive data or regulatory compliance requirements face particular risk from this vulnerability as it may violate data protection standards and access control policies.
Mitigation strategies should prioritize immediate upgrade to WeKan version 8.19 or later where this vulnerability has been addressed through proper access control implementation. Additionally, organizations should conduct comprehensive audits of their attachment metadata access patterns and implement network-level monitoring to detect unauthorized access attempts. Security teams should also review and strengthen their application security testing procedures to identify similar access control issues in other components. The fix typically involves implementing proper authorization checks at the database query level, ensuring that all attachment metadata queries include appropriate board and card access validation before returning results to authenticated users.