CVE-2026-25567 in WeKan
Summary
by MITRE • 02/08/2026
WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API. The endpoint accepts an authorId from the request body, allowing an authenticated user to spoof the recorded comment author by supplying another user's identifier.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/16/2026
The vulnerability identified as CVE-2026-25567 represents a critical insecure direct object reference flaw within the WeKan collaborative project management platform. This issue affects versions prior to 8.19 and specifically targets the card comment creation API endpoint. The vulnerability stems from insufficient input validation and authorization checks within the application's access control mechanisms. When users submit comments through the API, the system accepts an authorId parameter directly from the request payload without proper verification of the submitting user's permissions or identity. This design flaw allows authenticated users to manipulate the comment authorship by simply providing another user's identifier in the authorId field, effectively enabling impersonation attacks against the platform's collaborative features.
The technical exploitation of this vulnerability occurs through the manipulation of API request parameters within the card comment creation functionality. The API endpoint processes the authorId field without performing proper authorization checks to ensure that the authenticated user has the right to create comments on behalf of the specified user. This weakness aligns with CWE-284, which describes inadequate access control mechanisms where an attacker can bypass authorization checks to access unauthorized resources or perform unauthorized actions. The vulnerability essentially allows privilege escalation through direct object reference manipulation, where legitimate users can leverage their authentication status to spoof identities within the system's comment management framework.
The operational impact of this vulnerability extends beyond simple impersonation, potentially compromising the integrity of collaborative workflows and audit trails within WeKan environments. When attackers can create comments under false identities, they can manipulate the perceived authorship of project discussions, potentially leading to confusion among team members, compromised accountability, and potential misinformation within project documentation. This flaw undermines the trust model of collaborative platforms where comment authenticity is crucial for maintaining clear communication channels and proper attribution of project contributions. The vulnerability particularly affects environments where multiple users collaborate on shared boards and cards, as it enables malicious actors to inject false information or manipulate project narratives through forged comment authorship.
Organizations utilizing WeKan versions prior to 8.19 should immediately implement mitigations to address this vulnerability. The primary remediation involves strengthening the API endpoint's authorization logic to validate that the authenticated user can only create comments under their own identity or with proper administrative privileges. This includes implementing server-side validation that cross-references the authenticated session with the provided authorId parameter, ensuring that users cannot impersonate other users through API manipulation. Additionally, implementing proper access control checks within the application's authorization layer will prevent unauthorized object reference manipulation. Organizations should also consider implementing audit logging for comment creation activities to detect potential misuse of this vulnerability. The recommended solution aligns with ATT&CK technique T1078.004 which covers valid accounts and credential manipulation, as this vulnerability essentially allows attackers to leverage valid accounts through unauthorized manipulation of object references. Regular security updates and patch management procedures should be enforced to prevent similar issues in future deployments, as this vulnerability represents a fundamental flaw in the platform's access control architecture that could be exploited to undermine collaborative integrity and trust within project management environments.