CVE-2026-25565

Discovered by AISLEPUBLISHEDCWE-863

Description

WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring write permission. This can allow users with read-only roles to perform card updates that should require write access.

CVSS Base Scores

CVSS v4.07.1

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Products

VendorProductVersionStatus
WeKanWeKan0affected

Credits

  • Joshua Rogers(finder)

References