PT-2025-51218 · Wekan · Wekan

Siam Thanat Hack + 1 · Published 2025-12-15 · Updated 2025-12-18 · CVE-2025-65779

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 18.16

Description An issue exists in Wekan, an open-source kanban board system, where unauthenticated attackers can modify a board's "sort" value. The Boards.allow function does not verify the user ID, enabling unauthorized reordering of boards.

Recommendations Update to version 18.16 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-65779

Affected Products

Wekan

References · 10

• https://github.com/wekan/wekan/commit/ea310d7508b344512e5de0dfbc9bdfd38145c5c5 · Patch
• https://wekan.fi/hall-of-fame/spacebleed · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65779 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65779 · Security Note
• https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release · Note
• https://github.com/wekan/wekan · Note
• https://twitter.com/CVEnew/status/2000611247948284141 · Twitter Post
• https://t.me/cveNotify/146148 · Telegram Post
• https://t.me/CVEtracker/39827 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2000579394910273945 · Twitter Post