PT-2026-6931 · Wekan · Wekan

Joshua Rogers · Published 2026-02-07 · Updated 2026-02-10 · CVE-2026-25568

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WeKan versions prior to 8.19

Description An authorization issue exists in WeKan where the allowPrivateOnly instance configuration setting is not fully enforced during board creation. When allowPrivateOnly is enabled, users are still able to create public boards because of incomplete server-side checks. The vulnerability relates to insufficient enforcement of access controls during board creation, potentially allowing unauthorized access to board content.

Recommendations Update WeKan to version 8.19 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-25568

Affected Products

Wekan

References · 8

• https://github.com/wekan/wekan/commit/7ed76c180ede46ab1dac6b8ad27e9128a272c2c8 · Patch
• https://osv.dev/vulnerability/CVE-2026-25568 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25568 · Security Note
• https://twitter.com/CVEnew/status/2020261617259151482 · Twitter Post
• https://vulncheck.com/advisories/wekan-allowprivateonly-setting-enforcement-bypass · Note
• https://t.me/CVEtracker/44061 · Telegram Post
• https://t.me/cveNotify/151643 · Telegram Post
• https://wekan.fi · Note