PT-2025-51219 · Wekan · Wekan

Siam Thanat Hack + 1 · Published 2025-12-15 · Updated 2025-12-15 · CVE-2025-65780

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 18.16

Description Authenticated users can modify their entire user document, including organization and team memberships, and login status, due to insufficient server-side authorization checks. This allows for privilege escalation and unauthorized access to other teams and organizations.

Recommendations Update to version 18.16 or later.

Fix

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-65780

Affected Products

Wekan

References · 9

• https://github.com/wekan/wekan/commit/f26d58201855e861bab1cd1fda4d62c664efdb81 · Patch
• https://wekan.fi/hall-of-fame/spacebleed · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65780 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65780 · Security Note
• https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release · Note
• https://github.com/wekan/wekan · Note
• https://twitter.com/VulmonFeeds/status/2000576835055194362 · Twitter Post
• https://twitter.com/CVEnew/status/2000611248824795499 · Twitter Post
• https://t.me/CVEtracker/39828 · Telegram Post