CVE-2026-25564 in WeKan
Summary
by MITRE • 02/08/2026
WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not verify that the supplied cardId belongs to the supplied boardId, allowing cross-board ID tampering by manipulating identifiers.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/16/2026
The vulnerability identified as CVE-2026-25564 represents a critical insecure direct object reference flaw within the WeKan collaborative board management platform. This issue affects versions prior to 8.19 and specifically targets the checklist functionality within the application's architecture. The core problem manifests in the checklist creation and related checklist routes where the system fails to properly validate the relationship between cards and boards, creating a fundamental security gap that allows unauthorized access to cross-board resources.
The technical implementation flaw stems from inadequate input validation and access control mechanisms within the WeKan application's backend services. When users attempt to create checklists or perform operations on existing checklists, the system accepts cardId parameters without verifying that these identifiers correspond to legitimate board associations. This oversight creates a scenario where malicious actors can manipulate URL parameters or API requests to reference card identifiers that belong to different boards, effectively enabling them to access, modify, or delete checklist data across multiple board boundaries.
The operational impact of this vulnerability extends beyond simple data exposure, potentially allowing attackers to execute privilege escalation attacks and gain unauthorized access to sensitive information across different user boards. The vulnerability operates at the application layer and can be exploited through various attack vectors including direct API manipulation, web interface manipulation, or through crafted requests that exploit the missing validation checks. This type of vulnerability is particularly dangerous in collaborative environments where multiple users share boards and sensitive project data.
From a cybersecurity perspective, this vulnerability maps directly to CWE-284, which specifically addresses inadequate access control mechanisms, and aligns with ATT&CK technique T1078 for valid accounts and T1566 for spearphishing with a specific focus on access control bypass. The flaw represents a classic example of insufficient authorization checks that allows attackers to manipulate object references and gain access to resources they should not be permitted to access. Organizations using WeKan versions prior to 8.19 face significant risk of unauthorized data access, potential data corruption, and compromise of collaborative workspace integrity.
The recommended mitigation strategy involves immediate upgrade to WeKan version 8.19 or later, which includes proper validation mechanisms to ensure that card identifiers are properly scoped to their associated board contexts. Additionally, organizations should implement proper input sanitization, enforce strict access control policies, and conduct regular security assessments of their collaborative platforms. Network segmentation and monitoring solutions should be deployed to detect anomalous access patterns that might indicate exploitation attempts. The vulnerability serves as a reminder of the critical importance of proper access control implementation and the necessity of validating all object references within web applications, particularly those handling collaborative data environments.