CVE-2026-25568 in WeKan
Summary
by MITRE • 02/08/2026
WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforced at board creation time. When allowPrivateOnly is enabled, users can still create public boards due to incomplete server-side enforcement.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/16/2026
The vulnerability identified as CVE-2026-25568 represents a critical authorization logic flaw in WeKan versions prior to 8.19 that directly undermines the platform's access control mechanisms. This issue specifically affects the instance configuration setting known as allowPrivateOnly which is designed to restrict board creation to private boards only, preventing users from establishing publicly accessible boards within the system. The vulnerability stems from insufficient server-side enforcement of this security policy, creating a scenario where administrative configurations intended to enforce strict privacy controls are bypassed through improper validation during the board creation process.
The technical flaw manifests as a failure in the server-side validation logic that should enforce the allowPrivateOnly setting at the moment of board creation. When this configuration parameter is properly set to enable private-only board creation, the system should reject any attempts to create public boards regardless of user input or interface controls. However, the incomplete enforcement allows malicious or unauthorized users to circumvent these restrictions by directly manipulating the board creation process, potentially through API calls or direct database interactions that bypass the intended user interface validation checks. This represents a fundamental breakdown in the principle of least privilege and proper access control enforcement that is critical for collaborative platforms handling sensitive information.
The operational impact of this vulnerability extends beyond simple configuration bypass, as it fundamentally compromises the security posture of WeKan instances that rely on private-only board creation as a security control. Organizations using WeKan for collaborative workspaces, project management, or team coordination may inadvertently expose sensitive data through public boards that should never have been created in the first place. This vulnerability enables unauthorized information disclosure and potentially violates data protection regulations where access controls are mandated for specific types of information. The impact is particularly severe in environments where WeKan is used for handling confidential business data, personal information, or regulated content where public accessibility would constitute a serious security breach.
From a cybersecurity perspective, this vulnerability aligns with CWE-693 Protection Mechanism Failure, where the system fails to properly enforce security controls that are intended to protect against unauthorized access or data exposure. The flaw also relates to ATT&CK technique T1078 Valid Accounts, as it allows users to potentially gain unauthorized access to resources through manipulation of system configuration enforcement rather than through credential theft or other direct attack vectors. Organizations should immediately implement mitigations including upgrading to WeKan version 8.19 or later where this vulnerability has been addressed, conducting comprehensive security audits of existing boards to identify any unauthorized public boards that may have been created, and implementing additional monitoring controls to detect anomalous board creation patterns. The remediation process should also include re-evaluating all instance configurations to ensure proper enforcement of access control policies and implementing automated checks to verify that board creation restrictions are properly enforced at all times.