CVE-2026-25565 in WeKan
Summary
by MITRE • 02/08/2026
WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring write permission. This can allow users with read-only roles to perform card updates that should require write access.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/16/2026
This authorization vulnerability in WeKan versions prior to 8.19 represents a critical access control flaw that undermines the application's security model. The vulnerability stems from improper permission validation within the card update API endpoints, where the system only verifies board read access instead of enforcing the necessary write permissions. This design flaw creates a scenario where users with minimal read-only privileges can execute operations that should be restricted to authorized contributors with write capabilities. The issue manifests specifically in certain card update API paths, making it particularly concerning for collaborative environments where role-based access control is essential for maintaining data integrity and preventing unauthorized modifications.
The technical implementation of this vulnerability aligns with CWE-285, which addresses insufficient authorization in software systems. This weakness allows unauthorized users to perform privileged operations by exploiting the lack of proper access control checks. From an operational perspective, this vulnerability creates a pathway for malicious actors or disgruntled users with read-only access to modify card content, potentially altering task assignments, due dates, or other critical information. The impact extends beyond simple data modification to encompass potential data integrity breaches and unauthorized changes to collaborative workflows. Attackers could exploit this vulnerability to manipulate project timelines, redistribute tasks, or introduce misleading information into shared boards, undermining the trust and reliability of the collaborative platform.
The operational consequences of this authorization flaw are significant for organizations relying on WeKan for project management and collaboration. Users with read-only access can silently modify card data without proper audit trails, making it difficult to track unauthorized changes or identify malicious actors within the system. This vulnerability particularly affects environments where sensitive project information is managed through shared boards, as it creates opportunities for data manipulation that could impact project outcomes or compromise business operations. The lack of proper write permission enforcement means that even minor modifications can have cascading effects on project planning and resource allocation, potentially leading to operational disruptions or security incidents.
Organizations should immediately implement mitigations including upgrading to WeKan version 8.19 or later, which addresses this authorization vulnerability through proper permission validation. Additionally, administrators should review existing user roles and permissions to ensure that read-only users cannot perform write operations, even if they attempt to exploit this vulnerability. Implementing additional monitoring and logging of API calls can help detect unauthorized modifications, while regular security audits should verify that access controls function as intended. The ATT&CK framework categorizes this vulnerability under privilege escalation techniques, where attackers leverage insufficient access controls to gain unauthorized capabilities within a system. Organizations should also consider implementing network-level controls and API rate limiting to reduce the potential impact of exploitation attempts. Security teams must conduct thorough testing to verify that all card update API paths properly enforce write permissions, ensuring that the fix resolves the underlying authorization issue without introducing regressions in system functionality.