Wekan CVE-2025-65779

No special conditions - remote unauthenticated modification is possible against default configurations of Wekan at or below version 18.15, because the server-side Boards.allow authorization rule granted any update containing the 'sort' field without checking userId or board membership. The only prerequisite is network reachability to the Wekan server's data endpoint. The limiting factor is the narrow scope of what can be changed: an attacker can only alter the board 'sort' ordering value, not board contents, membership, or other fields; there is no authentication, user interaction, or non-default setting required to trigger it.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) is internally consistent with the description - the flaw is remotely reachable over the network, requires no authentication (PR:N, corroborated by the description's 'unauthenticated attackers' and the commit, where Boards.allow returned true without verifying userId), needs no user interaction, and affects only integrity. However, the I:H (High integrity) rating is almost certainly inflated: the actual tampering capability is limited to changing a board's 'sort' value, i.e. the display ordering of boards. This is a cosmetic/organizational data modification with no path to data disclosure (C:N), code execution, or disruption (A:N), so a real-world integrity impact of Low is more defensible than High. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided, so despite the 7.5 'High' headline number this is best characterized as a low-real-risk authorization defect rather than an urgent priority. The one genuinely notable signal is that exploitation is unauthenticated and trivially automatable, but because the downstream effect is merely board reordering, the practical consequence is nuisance-level tampering, not compromise. Net: patch during normal maintenance; this does not warrant emergency response.

A remote, unauthenticated attacker who can reach a Wekan instance's server endpoint issues a crafted update against the Boards collection setting the 'sort' field, which the vulnerable Boards.allow rule permits because it checks only that 'sort' is among the updated fields and never verifies the caller's userId or board membership. The attacker arbitrarily reorders boards for affected users. No public exploit code was provided in the intelligence, and the impact is limited to tampering with board ordering rather than reading or destroying data.