Wekan CVE-2025-65782

Requires an authenticated session on a Wekan instance (version ≤18.15) as a board member - and per the vendor description potentially any authenticated user - against a card that uses the voting (vote.positive/vote.negative) or planning-poker feature. The concrete prerequisite is the pre-patch client behavior in cardDetails.js, where setVote/setPoker wrote card vote fields directly from the client with no server-side ownership check, letting the caller substitute arbitrary userIds. Limiting factors that reduce realistic risk: exploitation requires valid authentication and (normally) board membership, impact is confined to vote/poker data integrity with no confidentiality or availability effect, and the issue is fully remediated in 18.16 which routes these actions through server methods enforcing that only the caller's own userId is modified.

This is a medium-severity authorization flaw (NVD CVSS 6.5, vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) that, on balance of all signals, is a LOW real-world priority rather than an urgent one. The CVSS vector confirms network-reachable, low-complexity, authenticated (PR:L) exploitation with no user interaction, but the impact is scoped entirely to integrity (C:N/A:N) of a narrow feature - card voting/planning-poker data. No EPSS score was provided in the input, there is no CISA KEV listing, and no public proof-of-concept is referenced, so exploitation probability signals are absent or neutral rather than elevated. I assess NVD's I:H rating as overstated: the confirmed commit (0a1a075f) shows the flaw only permits forging entries in vote.positive/vote.negative (and analogous poker buckets), which is a limited integrity impact on voting results, not system- or data-wide integrity - I would rate this I:L (see assessed vectors). No SSVC decision data was supplied. In short, this is a genuine but low-consequence authorization/business-logic bug requiring authenticated access; it warrants routine patching to 18.16 rather than emergency response.

An authenticated Wekan user who is a member of a board (and per the description potentially any authenticated user) crafts a card-update operation that directly writes other users' userIds into a card's vote.positive or vote.negative arrays, fabricating or removing votes they are not entitled to cast. Because the pre-18.16 client wrote vote/poker fields directly without server-side authorization, the attacker can skew vote tallies and planning-poker estimations to misrepresent team consensus. No public exploit is identified at time of analysis, and the low attack complexity (AC:L) means the manipulation requires no special timing or conditions once authenticated.