Wekan CVE-2025-65781

Exploitation requires network reachability to the Wekan attachment upload API endpoint (/api/attachment/*) on an instance running version 18.15 or earlier. The only precondition is sending any non-empty Authorization bearer token - no valid credentials, no specific configuration, and no user interaction are needed (CVSS PR:N/UI:N), because the pre-fix code accepts the bearer value as a userId and enters a non-terminating body-handling branch for any non-empty value. Limiting factors: the instance must be network-accessible to the attacker (internet-exposed or reachable internal deployment), and the reliably-achievable impact is availability (DoS); the integrity/identity-spoofing impact is characterized as 'latent' and may require additional conditions not detailed in the advisory.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, base 8.2) describes a remote, network-reachable, low-complexity flaw requiring no privileges or user interaction, with high availability impact and low integrity impact and no confidentiality impact - consistent with the description's 'trivial application-layer DoS' and 'latent identity-spoofing.' The root cause (CWE-287) is that the attachment upload API accepts the Authorization bearer value as a userId and enters a non-terminating body-handling branch for any non-empty token, so a single malformed request can hang connections and exhaust resources; the vendor fix (commit ccd9034) adds real token validation via Accounts._hashLoginToken, a 30-second timeout, and 50MB/10MB body-size limits, confirming both the DoS and the spoofing vectors. On real-world risk signals: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC is referenced, so there is no public exploit identified at time of analysis - meaning this is a genuine, easily-triggered flaw but without evidence of active exploitation or weaponization. The availability impact is the dominant, reliably-achievable outcome; the 'identity-spoofing' is described as 'latent,' so the I:L rating and real attack value are less certain and should be verified against the actual handler behavior. Net: a legitimate high-priority patch for any internet-exposed Wekan instance (trivially exploitable DoS), but overall campaign-level risk is tempered by the product's limited deployment footprint and absence of exploitation evidence.

An unauthenticated attacker sends a crafted request to the Wekan attachment upload API (/api/attachment/*) with any non-empty Authorization bearer value, causing the server to treat it as a userId and enter a non-terminating body-handling branch that hangs the connection. Repeating this concurrently exhausts server resources and denies service to legitimate users; the same mis-handling latently permits acting under a spoofed identity. No public exploit code is referenced, but the condition is trivial to reproduce from the description and vendor fix.