PT-2026-6928 · Wekan · Wekan

Joshua Rogers · Published 2026-02-07 · Updated 2026-02-08 · CVE-2026-25565

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WeKan versions prior to 8.19

Description WeKan contains an authorization issue in certain card update API paths. These paths only validate read access to a board instead of requiring write permission. This allows users with read-only roles to perform card updates that should require write access. The affected API paths are not explicitly named, but involve card updates.

Recommendations Update WeKan to version 8.19 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-25565

Affected Products

Wekan

References · 7

• https://github.com/wekan/wekan/commit/181f837d8cbae96bdf9dcbd31beaa3653c2c0285 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25565 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25565 · Vendor Advisory
• https://t.me/CVEtracker/44058 · Telegram Post
• https://twitter.com/CVEnew/status/2020261620081922269 · Twitter Post
• https://vulncheck.com/advisories/wekan-read-only-board-roles-can-update-cards · Note
• https://wekan.fi · Note