PT-2025-51221 · Wekan · Wekan

Siam Thanat Hack + 1 · Published 2025-12-15 · Updated 2025-12-15 · CVE-2025-65782

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 18.16

Description An authorization flaw exists in the card update handling process. This flaw allows board members, and potentially other authenticated users, to manipulate user IDs within the vote.positive and vote.negative arrays. This manipulation enables vote forgery and unauthorized voting. The affected system is an open-source kanban board.

Recommendations Update to version 18.16 or later.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-65782

Affected Products

Wekan

References · 8

• https://github.com/wekan/wekan/commit/0a1a075f3153e71d9a858576f1c68d2925230d9c · Patch
• https://wekan.fi/hall-of-fame/spacebleed · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65782 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65782 · Vendor Advisory
• https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release · Note
• https://github.com/wekan/wekan · Note
• https://t.me/CVEtracker/39830 · Telegram Post
• https://twitter.com/CVEnew/status/2000611250695549216 · Twitter Post