WeKan
CVE-2026-25566
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege WeKan account
-
DeliveryIdentify target board/list/swimlane IDs
-
ExploitSend crafted card-move REST request
-
ExecutionServer skips destination authorization check
-
PersistCard relocated across board boundary
-
ImpactRead or tamper with foreign board data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WeKan account with at least low privileges (PR:L) able to invoke the REST card-move endpoint, and the attacker must supply a destination board/list/swimlane ID via the newBoardId, newListId, and newSwimlaneId parameters. The condition is inherent to default configurations of any WeKan instance before 8.19 - no special feature toggle is required - but exploitation is realistically limited to multi-tenant/multi-team instances where the attacker can enumerate or guess destination object IDs. It does not permit fully unauthenticated access, and impact is bounded to unauthorized card relocation (integrity/read), not service availability. |
| Impact | The CVSS 4.0 base score of 7.1 reflects a network-reachable (AV:N), low-complexity (AC:L) flaw requiring an existing low-privilege authenticated account (PR:L) with no user interaction, yielding high integrity impact (VI:H) and low confidentiality impact (VC:L) but no availability impact. Real-world exploitation signals are muted: EPSS is 0.01% (1st percentile), it is not on the CISA KEV list, and no public exploit was identified - this is a genuine authorization weakness rather than a mass-exploited threat. The primary risk is data integrity and tenant isolation on shared WeKan instances, where any registered user could tamper with other teams' boards. Note that the VulnCheck tag labels this 'Authentication Bypass', but the PR:L vector and code evidence make clear it is a post-authentication authorization/access-control failure, not a pre-auth bypass - verify this distinction against the VulnCheck advisory. |
| Exploit ScenarioDerived | An attacker who registers or already holds a low-privilege account on a shared WeKan server sends a crafted REST card-move request specifying a newBoardId/newListId/newSwimlaneId belonging to another team's board. Because pre-8.19 WeKan never checks access to or ownership of the destination, the card is moved cross-board, letting the attacker read or disrupt content in boards they should not reach. No public exploit is identified, but the fixing commit diff plainly documents the missing checks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 14, 2026
Improper authorization in WeKan's card-move API lets an authenticated low-privilege user relocate cards to boards, lists, and swimlanes they do not control, because the destination is trusted without verifying access rights or that the target objects belong to the destination board. All WeKan versions before 8.19 are affected; no public exploit is identified at time of analysis and EPSS is negligible (0.01%), but the fixing commit publicly documents the missing checks, lowering the bar to reproduce.
Earlier versions of this analysis (2)
Improper authorization in WeKan's card-move API (versions prior to 8.19) lets an authenticated user relocate a card to a destination board, list, or swimlane they do not control, because the endpoint neither verified access to the target board nor confirmed that the specified list/swimlane actually belonged to it. An attacker with a low-privilege account can push cards into boards they should not reach, undermining data integrity and workflow isolation. No public exploit identified at time of analysis; EPSS is negligible at 0.01% and the flaw is not in CISA KEV.
WeKan versions prior to 8.19 contain an authorization vulnerability in card move logic. [CVSS 5.4 MEDIUM]
RemediationAI
Vendor-released patch: upgrade to WeKan 8.19 or later, which adds destination board access validation and list/swimlane ownership checks in the card-move API (fix commit https://github.com/wekan/wekan/commit/198509e7600981400353aec6259247b3c04e043e). If immediate upgrade is not possible, restrict account provisioning so only trusted users hold board membership, and place the WeKan instance behind network/access controls such as a VPN or SSO-gated reverse proxy to shrink the pool of potential authenticated attackers; note these controls do not stop an already-registered malicious user and only reduce exposure. Until patched, monitor application logs and audit trails for unexpected cross-board card moves as a detective control. See the VulnCheck advisory at https://www.vulncheck.com/advisories/wekan-cross-board-card-move-without-destination-authorization for details.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WeKan is an open-source, self-hosted Kanban board (a Trello alternative) built on Meteor/Node.js with a MongoDB backend. The flaw lives in the REST card-move logic in models/cards.js, which accepts caller-supplied newBoardId, newListId, and newSwimlaneId parameters. This is a CWE-863 (Incorrect Authorization) issue: the code performed the move without calling Authentication.checkBoardAccess on the destination board and without confirming that the destination list and swimlane actually belong to that board. The vendor fix (commit 198509e) adds an explicit checkBoardAccess call plus ReactiveCache lookups that reject the request with HTTP 404 when the destination list or swimlane does not exist under the target board.
Know when Wekan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Authenticated low-priv user over network, no UI (PR:L, AV:N, UI:N); high integrity from unauthorized cross-board moves, low confidentiality from viewing foreign cards, no availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
6DescriptionCVE.org
WeKan versions prior to 8.19 contain an authorization vulnerability in card move logic. A user can specify a destination board/list/swimlane without adequate authorization checks for the destination and without validating that destination objects belong to the destination board, potentially enabling unauthorized cross-board moves.
Executive ViewAI
WeKan prior to version 8.19 contains an authorization bypass in the card-move API that allows low-privilege authenticated users to move task cards into restricted projects and lists outside their assigned scope. No public exploit identified at time of analysis. Organizations using WeKan for sensitive project management face data exposure and project integrity risks until patched to version 8.19.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by t
OS command injection in Wekan (the open-source Meteor-based kanban board) before version 9.07 lets an authenticated user
Authentication bypass in Wekan (open-source Meteor kanban) before version 9.46 lets an unauthenticated attacker imperson
A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticate
Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scrip
Account takeover in Wekan (open-source Meteor kanban) before 9.32 allows an attacker who controls an OIDC provider accou
Privilege escalation in Wekan open-source kanban (all versions prior to 9.89, dubbed 'SortBleed') allows any board membe
Privilege escalation in the self-hosted Wekan kanban board through version 18.15 allows any authenticated user to rewrit
Stored XSS in Wekan prior to v9.90 allows authenticated board members to upload HTML containing JavaScript disguised as
LDAP filter injection in WeKan before 8.19 allows remote unauthenticated attackers to manipulate LDAP search filters and
Privilege escalation in WeKan (versions prior to 8.35) allows authenticated board members with low privileges to perform
Wekan's outgoing webhook URL validator in versions 8.36 through 9.73 allows authenticated board members to bypass SSRF p
Exploit-DB