PT-2026-6930 · Wekan · Wekan

Joshua Rogers · CVE-2026-25567 · Published 2026-02-07 · Updated 2026-02-10

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WeKan versions prior to 8.19

Description WeKan contains an insecure direct object reference (IDOR) in the card comment creation API. The API endpoint accepts an authorId from the request body, which allows an authenticated user to spoof the recorded comment author by providing another user's identifier.

Recommendations Update WeKan to version 8.19 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-25567

Affected Products

Wekan

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25567.json · Exploit
• https://github.com/wekan/wekan/commit/67cb47173c1a152d9eaf5469740992b2dacdf62d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25567 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25567 · Vendor Advisory
• https://github.com/wekan/wekan · Note
• https://t.me/CVEtracker/44060 · Telegram Post
• https://t.me/cveNotify/151642 · Telegram Post
• https://twitter.com/CVEnew/status/2020261618186105187 · Twitter Post
• https://vulncheck.com/advisories/wekan-card-comment-author-spoofing-via-user-controlled-authorid · Note
• https://wekan.fi · Note