WeKan
CVE-2026-25561
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to WeKan instance
-
DeliveryCall attachment upload/move API
-
ExploitSupply mismatched board/card/swimlane/list IDs
-
ExecutionServer skips relationship validation
-
ImpactAttach or relocate data outside intended hierarchy
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated WeKan account (CVSS PR:L) that can call the attachment upload/move REST API in server/routes/attachmentApi.js; no user interaction (UI:N) and no elevated privileges are needed beyond that account. The concrete trigger is submitting attachment requests with mismatched relationship identifiers - a cardId whose real boardId, swimlaneId, or listId differs from the boardId/swimlaneId/listId supplied in the request - which pre-8.19 servers fail to reconcile. Limiting factors: exploitation is impossible for fully unauthenticated outsiders, impact is integrity-only (no data disclosure or denial of service per VC:N/VA:N), and any instance already upgraded to 8.19+ rejects the mismatched identifiers with HTTP 400/404. |
| Impact | The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) describes a network-reachable, low-complexity, authenticated attack with integrity-only impact and no confidentiality or availability loss, scoring 7.1 - consistent with an authorization/IDOR-style data-tampering bug rather than a system-compromise flaw. Real-world risk is tempered: EPSS is 0.01% (1st percentile), there is no KEV listing and no public exploit identified, and PR:L means the attacker must already hold a valid authenticated account on the WeKan instance. The vendor's VI:H rating is arguably aggressive for what the description frames as accepting mismatched relationship identifiers on attachment operations; the practical integrity impact may be closer to moderate/limited unless it enables writing to boards the user cannot otherwise access - verify actual cross-tenant impact against the vendor advisory. Net: a legitimate authorization hardening fix worth patching, but not an urgent internet-wide priority given the authentication requirement and negligible exploitation probability. |
| Exploit ScenarioDerived | An authenticated WeKan user with access to a board crafts an attachment upload or move API request supplying a cardId, boardId, swimlaneId, and listId that do not form a coherent relationship - for example a card from one board paired with a different board's identifiers. On vulnerable versions the server accepts the mismatched relationship instead of rejecting it, letting the attacker attach or relocate attachment data outside the intended object hierarchy. No public exploit code is identified, and the attack requires a valid low-privileged account (PR:L) over the network with no user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 14, 2026
Improper authorization in the WeKan attachment upload API (versions prior to 8.19) lets an authenticated low-privileged user submit inconsistent object identifiers (boardId, cardId, swimlaneId, listId) that the server fails to cross-validate, allowing attachments to be associated with or moved across card/board relationships the user should not control. The affected component is the self-hosted open-source kanban platform WeKan; the fix (commit 1d16955b) adds server-side checks that a card actually belongs to the named board, swimlane, and list. No public exploit identified at time of analysis, EPSS is negligible (0.01%), and it is not in CISA KEV.
Earlier versions of this analysis (2)
Broken authorization in the WeKan attachment upload API (all versions prior to 8.19) allows an authenticated board user to upload or move attachments using mismatched boardId, cardId, swimlaneId, and listId identifiers, because the server never verified that these IDs referred to a coherent card/board/swimlane/list relationship. An attacker with a low-privilege account can therefore attach files to card/board relationships that should not be permitted, corrupting object relationships across the kanban structure. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and the flaw is not in CISA KEV.
WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API. [CVSS 7.5 HIGH]
RemediationAI
Upgrade WeKan to version 8.19 or later, which includes the attachment-API relationship validation fix (commit 1d16955b6d4f0a0282e89c2c1b0415c7597019b8); because the input provides a fix commit and an implied release boundary (prior to 8.19), treat 8.19 as the patched version but confirm the exact tagged release on the WeKan project before deploying. If immediate upgrade is not possible, restrict who can reach the attachment upload/move endpoints - limit WeKan accounts to trusted users, keep the instance behind authenticated network controls, and monitor attachment API activity for cross-board identifier mismatches; the trade-off is that tightening account provisioning reduces collaboration convenience but shrinks the pool of users who could abuse the authenticated endpoint. Review the VulnCheck advisory (https://www.vulncheck.com/advisories/wekan-attachment-upload-object-relationship-validation-bypass) for vendor guidance.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WeKan is a Meteor/Node.js self-hosted kanban application (a Trello-style board tool). The flaw resides in server/routes/attachmentApi.js, the REST endpoint handling attachment uploads and moves. The root cause is CWE-863 (Incorrect Authorization): the API trusted caller-supplied relationship identifiers instead of verifying that the referenced card genuinely belongs to the specified board and that the swimlaneId/listId match the card's real swimlane and list. The patch inserts explicit consistency checks (card.boardId ! boardId, card.swimlaneId ! swimlaneId, card.listId !== listId, plus equivalent target-card checks on move operations) that return HTTP 400/404 on mismatch, closing the gap where mismatched object relationships were accepted.
Know when Wekan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable authenticated API (AV:N/PR:L) with no UI; impact is limited data-relationship tampering (I:L) with no confidentiality or availability loss, so I assess lower than the vendor's VI:H.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
5DescriptionCVE.org
WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API. The API does not fully validate that provided identifiers (such as boardId, cardId, swimlaneId, and listId) are consistent and refer to a coherent card/board relationship, enabling attempts to upload attachments with mismatched object relationships.
Executive ViewAI
WeKan versions prior to 8.19 contain an authorization flaw allowing authenticated users to access attachments in other teams' cards and boards. Organizations must upgrade to version 8.19 or later to prevent internal data leakage through unauthorized file access.
Vendor-released patch: WeKan 8.19 and later. Interim mitigations pending upgrade include restricting WeKan user provisioning to trusted staff and enabling attachment access audit logs to detect cross-boundary access attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by t
OS command injection in Wekan (the open-source Meteor-based kanban board) before version 9.07 lets an authenticated user
Authentication bypass in Wekan (open-source Meteor kanban) before version 9.46 lets an unauthenticated attacker imperson
A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticate
Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scrip
Account takeover in Wekan (open-source Meteor kanban) before 9.32 allows an attacker who controls an OIDC provider accou
Privilege escalation in Wekan open-source kanban (all versions prior to 9.89, dubbed 'SortBleed') allows any board membe
Privilege escalation in the self-hosted Wekan kanban board through version 18.15 allows any authenticated user to rewrit
Stored XSS in Wekan prior to v9.90 allows authenticated board members to upload HTML containing JavaScript disguised as
LDAP filter injection in WeKan before 8.19 allows remote unauthenticated attackers to manipulate LDAP search filters and
Privilege escalation in WeKan (versions prior to 8.35) allows authenticated board members with low privileges to perform
Wekan's outgoing webhook URL validator in versions 8.36 through 9.73 allows authenticated board members to bypass SSRF p
Exploit-DB