CVE-2026-25566 in WeKan
Summary
by MITRE • 02/08/2026
WeKan versions prior to 8.19 contain an authorization vulnerability in card move logic. A user can specify a destination board/list/swimlane without adequate authorization checks for the destination and without validating that destination objects belong to the destination board, potentially enabling unauthorized cross-board moves.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 02/19/2026
This vulnerability exists within the WeKan collaborative project management platform where users can manipulate card movements between different boards, lists, and swimlanes. The authorization flaw stems from insufficient validation mechanisms that fail to properly verify user permissions when moving cards across board boundaries. The vulnerability affects all versions prior to 8.19 and represents a critical security weakness that undermines the platform's access control model. This issue allows malicious or unauthorized users to bypass normal permission boundaries and move cards between boards they should not have access to, creating potential data exposure and integrity violations.
The technical implementation flaw occurs in the card movement logic where the system does not perform adequate authorization checks before permitting a card to be moved to a destination board, list, or swimlane. Specifically, the system fails to validate whether the destination objects belong to the destination board itself, creating a scenario where users can specify arbitrary destination parameters without proper verification. This authorization bypass allows attackers to construct malicious move operations that target boards they do not own or have access to, effectively breaking the isolation between different board environments. The vulnerability is particularly concerning because it operates at the application logic level rather than being a simple authentication failure.
The operational impact of this vulnerability extends beyond simple unauthorized access to potentially enabling data leakage and manipulation across different project environments. An attacker with access to one board could move cards containing sensitive information to other boards where they have elevated privileges or where the information could be accessed by unauthorized users. This cross-board movement capability could facilitate information disclosure attacks, where confidential project data is transferred to boards accessible by different user groups. The vulnerability also undermines the platform's ability to maintain proper data segregation between different teams or projects, potentially enabling privilege escalation and unauthorized data manipulation.
Mitigation strategies should focus on implementing comprehensive authorization checks before any card movement operations are permitted. The system must validate that destination objects belong to the specified destination board and verify that the user has appropriate permissions for both source and destination locations. This includes implementing proper access control lists and ensuring that all move operations are validated against the user's actual permissions. Organizations should immediately upgrade to WeKan version 8.19 or later where this vulnerability has been patched. Additionally, administrators should review existing board permissions and implement network-level restrictions to limit access to sensitive boards. The vulnerability aligns with CWE-285 which addresses improper authorization in software systems, and represents a clear violation of the principle of least privilege as outlined in the MITRE ATT&CK framework under the privilege escalation category.