PT-2026-6931 · Wekan · Wekan

Joshua Rogers · Publicado 2026-02-07 · Atualizado 2026-02-10 · CVE-2026-25568

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WeKan versions prior to 8.19

Description An authorization issue exists in WeKan where the allowPrivateOnly instance configuration setting is not fully enforced during board creation. When allowPrivateOnly is enabled, users are still able to create public boards because of incomplete server-side checks. The vulnerability relates to insufficient enforcement of access controls during board creation, potentially allowing unauthorized access to board content.

Recommendations Update WeKan to version 8.19 or later.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-25568

Produtos afetados

Wekan

Referências · 8

• https://github.com/wekan/wekan/commit/7ed76c180ede46ab1dac6b8ad27e9128a272c2c8 · Correção
• https://twitter.com/CVEnew/status/2020261617259151482 · Publicação no Twitter
• https://vulncheck.com/advisories/wekan-allowprivateonly-setting-enforcement-bypass · Nota
• https://osv.dev/vulnerability/CVE-2026-25568 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25568 · Nota de Segurança
• https://t.me/CVEtracker/44061 · Publicação no Telegram
• https://t.me/cveNotify/151643 · Publicação no Telegram
• https://wekan.fi · Nota