WeKan
CVE-2026-25564
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryEnumerate foreign card/checklist IDs
-
ExploitCraft checklist request with mismatched board/card IDs
-
ExecutionServer skips relationship validation
-
ImpactCreate or delete checklists cross-board
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated WeKan account with at least low privileges (CVSS PR:L) and network access to the REST API; no user interaction is needed (UI:N). The concrete prerequisite is the ability to submit checklist route requests (creation/deletion/related endpoints) with mismatched boardId and cardId parameters, plus knowledge or enumeration of a target card's identifiers on a board the attacker does not belong to. Limiting factors: an account is mandatory (this is not unauthenticated), the attacker must know or brute-force valid foreign cardId/checklistId values, and only instances running versions prior to 8.19 are vulnerable. Impact is confined to checklist integrity and minor availability - no confidentiality disclosure and no code execution per the CVSS vector. |
| Impact | Signals are internally consistent and point to a real but bounded issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows a network-reachable, low-complexity attack requiring only a low-privileged authenticated account and no user interaction, with high integrity impact (VI:H), low availability impact (VA:L), and no confidentiality impact (VC:N) - matching an IDOR that tampers with or deletes checklists rather than exfiltrating data. EPSS is 0.01% (1st percentile) and the CVE is not in CISA KEV, indicating no observed or predicted mass exploitation. This is a legitimate authorization defect that should be patched, but it is not an emergency: exploitation requires a valid account on the target instance, and impact is limited to checklist integrity/availability across boards, not full account takeover or code execution. Note a minor sourcing discrepancy: the NVD description frames this as 'checklist creation,' while the linked VulnCheck advisory title references 'checklist deletion' - both are consistent with the same missing relationship validation across checklist routes, but verify the exact affected endpoints against the vendor advisory. |
| Exploit ScenarioDerived | A low-privileged authenticated WeKan user enumerates or guesses cardId and checklistId values from a board they do not belong to, then sends a crafted REST request to a checklist route supplying their own boardId with a foreign cardId. Because the server never verified the card belongs to the board, the attacker creates or deletes checklists on another team's card. No public exploit code has been identified, and the network attack vector with low complexity makes the request trivial to script once valid IDs are known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv4 – Jul 14, 2026
Cross-board data tampering in WeKan (open-source Trello-style kanban board) before version 8.19 lets an authenticated low-privileged user manipulate checklists on cards belonging to boards they should not access. The checklist creation, deletion, and related REST routes accept a cardId without confirming it belongs to the supplied boardId, so an attacker can forge identifiers to add or remove checklists on other users' cards. No public exploit identified at time of analysis, and EPSS is negligible (0.01%), but the vendor fix commit confirms the root cause and a straightforward exploitation path.
Earlier versions of this analysis (3)
Cross-board data tampering in WeKan (open-source Trello-style kanban board) before version 8.19 allows an authenticated low-privileged user to create, modify, or delete checklists on cards belonging to boards they should not have access to. The checklist REST routes accept a cardId and boardId without validating that the card actually belongs to the board, so an attacker who can manipulate the identifiers can affect other boards' checklists. No public exploit identified at time of analysis, and the EPSS score is negligible (0.01%), indicating little evidence of opportunistic exploitation.
Cross-board data tampering in WeKan before 8.19 lets an authenticated low-privilege user manipulate checklists on cards they should not control by forging cardId and boardId identifiers on checklist creation and related routes. The server never validates that the supplied cardId actually belongs to the supplied boardId, so an attacker with a valid session on one board can add, alter, or delete checklists on another board's cards. No public exploit or active exploitation is known (EPSS 0.01%, not in CISA KEV), but the integrity impact is rated high (CVSS 4.0 base 7.1).
Wekan versions up to 8.19 is affected by authorization bypass through user-controlled key (CVSS 7.5).
RemediationAI
Vendor-released patch: upgrade WeKan to version 8.19 or later, which incorporates fix commit 08a6f084 adding card-to-board and checklist-to-card relationship validation on the affected checklist routes (see https://github.com/wekan/wekan/commit/08a6f084eba09487743a7c807fb4a9000fcfa9ac). If immediate upgrade is not possible, reduce exposure by restricting who holds accounts on the instance and by limiting network reachability of the WeKan API to trusted users (e.g. VPN or reverse-proxy access controls), since exploitation requires an authenticated low-privileged session; be aware this does not fix the underlying IDOR and only shrinks the attacker population. Review board membership and audit checklist changes for signs of tampering. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/wekan-checklist-deletion-idor-via-missing-relationship-validation) for endpoint-specific details.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WeKan is a Meteor/Node.js kanban application whose server-side REST API (models/checklists.js) exposes routes keyed by boardId, cardId, and checklistId. The flaw is a classic CWE-639 Authorization Bypass Through User-Controlled Key (IDOR): the handler trusted the caller-supplied cardId and never validated the parent-child relationship between board, card, and checklist. The vendor fix (commit 08a6f084) adds two ReactiveCache lookups - one confirming the card's _id is scoped to the requested boardId, and one confirming the checklist's _id is scoped to that cardId - returning HTTP 404 when the relationship does not hold. The single CPE cpe:2.3:a:wekan_project:wekan covers all pre-8.19 builds.
Know when Wekan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Network REST API with low complexity and no interaction, but a low-privileged account is required (PR:L); IDOR tampers with/deletes checklists giving I:H and A:L, with no data disclosure (C:N).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
6DescriptionCVE.org
WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not verify that the supplied cardId belongs to the supplied boardId, allowing cross-board ID tampering by manipulating identifiers.
Executive ViewAI
WeKan deployments prior to version 8.19 are vulnerable to unauthorized cross-project data access, allowing authenticated users to view and modify checklists on cards from boards outside their permission scope. This data segregation failure creates risk of operational disruption, workflow tampering, and potential information leaks across teams relying on the platform for collaborative work. Organizations using WeKan require immediate patching to restore proper access controls.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by t
OS command injection in Wekan (the open-source Meteor-based kanban board) before version 9.07 lets an authenticated user
Authentication bypass in Wekan (open-source Meteor kanban) before version 9.46 lets an unauthenticated attacker imperson
A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticate
Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scrip
Account takeover in Wekan (open-source Meteor kanban) before 9.32 allows an attacker who controls an OIDC provider accou
Privilege escalation in Wekan open-source kanban (all versions prior to 9.89, dubbed 'SortBleed') allows any board membe
Privilege escalation in the self-hosted Wekan kanban board through version 18.15 allows any authenticated user to rewrit
Stored XSS in Wekan prior to v9.90 allows authenticated board members to upload HTML containing JavaScript disguised as
LDAP filter injection in WeKan before 8.19 allows remote unauthenticated attackers to manipulate LDAP search filters and
Privilege escalation in WeKan (versions prior to 8.35) allows authenticated board members with low privileges to perform
Wekan's outgoing webhook URL validator in versions 8.36 through 9.73 allows authenticated board members to bypass SSRF p
Exploit-DB