PT-2026-6929 · Wekan · Wekan

Joshua Rogers · Published 2026-02-07 · Updated 2026-02-18 · CVE-2026-25566

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WeKan versions prior to 8.19

Description An authorization issue exists in the card move logic of the software. A user can define a destination board, list, or swimlane without sufficient authorization verification for the destination. The system also fails to confirm that destination objects are part of the intended board, potentially allowing unauthorized card movements between boards.

Recommendations Update to version 8.19 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-25566

Affected Products

Wekan

References · 8

• https://github.com/wekan/wekan/commit/198509e7600981400353aec6259247b3c04e043e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25566 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25566 · Vendor Advisory
• https://t.me/cveNotify/152424 · Telegram Post
• https://wekan.fi · Note
• https://twitter.com/CVEnew/status/2020261619188523329 · Twitter Post
• https://t.me/CVEtracker/44059 · Telegram Post
• https://vulncheck.com/advisories/wekan-cross-board-card-move-without-destination-authorization · Note