PT-2026-6924 · Wekan · Wekan

Joshua Rogers · Published 2026-02-07 · Updated 2026-02-08 · CVE-2026-25561

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions WeKan versions prior to 8.19

Description The software contains an authorization weakness in the attachment upload API. The API does not fully validate identifiers such as boardId, cardId, swimlaneId, and listId to ensure they correctly relate to a coherent card/board relationship. This allows attempts to upload attachments with mismatched object relationships.

Recommendations Update to version 8.19 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-25561

Affected Products

Wekan

References · 7

• https://github.com/wekan/wekan/commit/1d16955b6d4f0a0282e89c2c1b0415c7597019b8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25561 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25561 · Vendor Advisory
• https://vulncheck.com/advisories/wekan-attachment-upload-object-relationship-validation-bypass · Note
• https://wekan.fi · Note
• https://twitter.com/CVEnew/status/2020261623890346023 · Twitter Post
• https://t.me/CVEtracker/44054 · Telegram Post