PT-2026-6925 · Wekan · Wekan

Joshua Rogers · CVE-2026-25562 · Published 2026-02-07 · Updated 2026-02-08

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WeKan versions prior to 8.19

Description WeKan versions before 8.19 have an issue where attachment metadata might be revealed to users who should not have access. This happens because the system doesn’t properly limit which attachment details are shown to each user, potentially exposing information about attachments on boards and cards they aren’t authorized to view.

Recommendations Update WeKan to version 8.19 or later.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2026-25562

Affected Products

Wekan

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25562.json · Exploit
• https://github.com/wekan/wekan/commit/6dfa3beb2b6ab23438d0f4395b84bf0749eb4820 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25562 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25562 · Vendor Advisory
• https://github.com/wekan/wekan · Note
• https://twitter.com/CVEnew/status/2020261623001121027 · Twitter Post
• https://t.me/CVEtracker/44055 · Telegram Post
• https://vulncheck.com/advisories/wekan-attachments-publication-information-disclosure · Note
• https://wekan.fi · Note