PT-2026-6927 · Wekan · Wekan

Joshua Rogers · CVE-2026-25564 · Published 2026-02-07 · Updated 2026-02-08

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions WeKan versions prior to 8.19

Description The software contains an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not verify that the supplied cardId belongs to the supplied boardId, allowing cross-board ID tampering by manipulating identifiers.

Recommendations Update to version 8.19 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-25564

Affected Products

Wekan

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25564.json · Exploit
• https://github.com/wekan/wekan/commit/08a6f084eba09487743a7c807fb4a9000fcfa9ac · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25564 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25564 · Vendor Advisory
• https://github.com/wekan/wekan · Note
• https://vulncheck.com/advisories/wekan-checklist-deletion-idor-via-missing-relationship-validation · Note
• https://twitter.com/CVEnew/status/2020261621059268827 · Twitter Post
• https://t.me/CVEtracker/44057 · Telegram Post
• https://wekan.fi · Note