WeKan
CVE-2026-25566
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-priv user over network, no UI (PR:L, AV:N, UI:N); high integrity from unauthorized cross-board moves, low confidentiality from viewing foreign cards, no availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
9DescriptionCVE.org
WeKan versions prior to 8.19 contain an authorization vulnerability in card move logic. A user can specify a destination board/list/swimlane without adequate authorization checks for the destination and without validating that destination objects belong to the destination board, potentially enabling unauthorized cross-board moves.
AnalysisAI
Improper authorization in WeKan's card-move API lets an authenticated low-privilege user relocate cards to boards, lists, and swimlanes they do not control, because the destination is trusted without verifying access rights or that the target objects belong to the destination board. All WeKan versions before 8.19 are affected; no public exploit is identified at time of analysis and EPSS is negligible (0.01%), but the fixing commit publicly documents the missing checks, lowering the bar to reproduce.
Technical ContextAI
WeKan is an open-source, self-hosted Kanban board (a Trello alternative) built on Meteor/Node.js with a MongoDB backend. The flaw lives in the REST card-move logic in models/cards.js, which accepts caller-supplied newBoardId, newListId, and newSwimlaneId parameters. This is a CWE-863 (Incorrect Authorization) issue: the code performed the move without calling Authentication.checkBoardAccess on the destination board and without confirming that the destination list and swimlane actually belong to that board. The vendor fix (commit 198509e) adds an explicit checkBoardAccess call plus ReactiveCache lookups that reject the request with HTTP 404 when the destination list or swimlane does not exist under the target board.
RemediationAI
Vendor-released patch: upgrade to WeKan 8.19 or later, which adds destination board access validation and list/swimlane ownership checks in the card-move API (fix commit https://github.com/wekan/wekan/commit/198509e7600981400353aec6259247b3c04e043e). If immediate upgrade is not possible, restrict account provisioning so only trusted users hold board membership, and place the WeKan instance behind network/access controls such as a VPN or SSO-gated reverse proxy to shrink the pool of potential authenticated attackers; note these controls do not stop an already-registered malicious user and only reduce exposure. Until patched, monitor application logs and audit trails for unexpected cross-board card moves as a detective control. See the VulnCheck advisory at https://www.vulncheck.com/advisories/wekan-cross-board-card-move-without-destination-authorization for details.
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by t
OS command injection in Wekan (the open-source Meteor-based kanban board) before version 9.07 lets an authenticated user
Authentication bypass in Wekan (open-source Meteor kanban) before version 9.46 lets an unauthenticated attacker imperson
A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticate
Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scrip
Account takeover in Wekan (open-source Meteor kanban) before 9.32 allows an attacker who controls an OIDC provider accou
LDAP filter injection in WeKan before 8.19 allows remote unauthenticated attackers to manipulate LDAP search filters and
Privilege escalation in WeKan (versions prior to 8.35) allows authenticated board members with low privileges to perform
Improper access control in Wekan (self-hosted open-source Meteor kanban) before version 9.37 lets any authenticated user
Wekan versions 8.31.0 through 8.33 expose webhook URLs and authentication tokens to all board members through unfiltered
Server-Side Request Forgery in Wekan 8.32-8.33 allows authenticated users to force the server to make arbitrary HTTP req
Privilege escalation in Wekan (self-hosted Meteor kanban) before 9.32 lets any authenticated user directly invoke OIDC-o
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today