Wekan
CVE-2026-25859
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Wekan user
-
DeliveryAccess target board over network
-
ExploitInvoke unguarded migration Meteor method
-
ExecutionExecute unauthorized board migration
-
ImpactAlter board structure/data integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must hold an authenticated, non-administrative Wekan account (CVSS PR:L) with network access to the instance; no user interaction is required. The specific prerequisite is access to the migration functionality that is exposed to non-admin users in versions before 8.20 - the vulnerable server-side migration methods (comprehensiveBoardMigration.execute and related conversion routines) are invokable without the board-admin authorization that the 8.20 patch adds. Limiting factors: exploitation is impossible for fully unauthenticated actors, and post-patch the migration trigger is restricted to board administrators via the sidebar Migrations menu, so instances on 8.20+ or those with tightly controlled user accounts are not exposed. |
| Impact | The CVSS 4.0 base score is 7.1 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N and impact VC:N/VI:H/VA:L - network-reachable, low complexity, requires low privileges (an authenticated user), no user interaction, and damage is primarily to integrity (unauthorized data/structure modification) with limited availability impact and no confidentiality loss. Real-world exploitation risk is tempered: EPSS is only 0.05% (15th percentile), the CVE is NOT on the CISA KEV list (no confirmed active exploitation), and no public exploit code is identified. The main mitigating factor is PR:L - an attacker must already be an authenticated Wekan user, so this is a privilege-boundary/insider issue rather than a pre-auth internet-facing RCE. The signals are consistent (moderate CVSS driven by integrity impact, low EPSS, no KEV/POC), so this is a legitimate but non-urgent patch-in-normal-cycle issue, especially for instances exposed only to trusted internal users. |
| Exploit ScenarioDerived | A regular Wekan user who has been invited to a board (or holds any authenticated account) directly invokes the migration/conversion Meteor methods that lack an admin permission check, triggering a comprehensive board migration on a board they do not administer. This forces structural changes to board data - converting shared lists, altering cards/swimlanes - without authorization; no public exploit is identified, but the low attack complexity (AC:L) and network vector make abuse straightforward for any logged-in user. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 14, 2026
Broken authorization in Wekan versions prior to 8.20 lets any authenticated non-administrative user invoke board migration functionality that should be restricted to board administrators. Because permission checks on the migration methods (e.g. comprehensiveBoardMigration.execute) are insufficient, a low-privileged user can trigger unauthorized migration operations that mutate board structure and data. EPSS is very low (0.05%, 15th percentile) and there is no public exploit identified at time of analysis, but a vendor patch and fix commit are available.
Earlier versions of this analysis (2)
Broken access control in the open-source Wekan kanban board (all versions before 8.20) lets authenticated low-privilege users invoke board migration/conversion routines that should be restricted to board administrators, allowing them to trigger unauthorized data-migration operations that alter board structure, lists, cards, and attachment references. The flaw is an improper authorization (CWE-863) issue where migration Meteor methods and client entry points were exposed without adequate permission checks. It is not in CISA KEV and has a very low EPSS (0.05%), so no public exploit is identified at time of analysis, but a vendor patch is available.
Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in unauthorized migration operations. [CVSS 8.8 HIGH]
RemediationAI
Vendor-released patch: upgrade to Wekan 8.20 or later, which restricts migration functionality to board administrators and disables automatic migration (fix commit https://github.com/wekan/wekan/commit/cbb1cd78de3e40264a5e047ace0ce27f8635b4e6). If you cannot upgrade immediately, reduce exposure by restricting Wekan account provisioning to trusted users and reviewing which users hold board access, since exploitation requires an authenticated low-privileged account - shrinking the authenticated user population directly shrinks the attack surface, at the cost of collaboration convenience. Monitor server logs for unexpected calls to migration/conversion methods and unexpected board-structure changes so unauthorized migration operations can be detected and rolled back. See the VulnCheck advisory (https://www.vulncheck.com/advisories/wekan-migration-functionality-insufficient-permission-checks) and vendor site (https://wekan.fi/) for release details.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Wekan is a self-hosted, open-source kanban board built on the Meteor JavaScript framework (Node.js + MongoDB), the affected product per CPE cpe:2.3:a:wekan_project:wekan:*. The root cause maps to CWE-863 (Incorrect Authorization): server-side Meteor methods that drive board migration/conversion (the diff references comprehensiveBoardMigration.needsMigration and comprehensiveBoardMigration.execute, plus a client-side migrationManager) did not enforce that the caller holds board-admin privileges. The patch commit (cbb1cd78de3e40264a5e047ace0ce27f8635b4e6) removes automatic migration on board load and refactors migrations so they are only run manually from the sidebar Migrations menu by board admins, swaps the old client migrationManager for an attachmentMigrationManager, and relocates migrationProgress under settings - indicating the fix centralizes and gates the migration trigger rather than exposing it to every board viewer.
Know when Wekan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Authenticated low-priv user over the network invokes unguarded migration methods, so PR:L/AC:L/AV:N; impact is integrity-focused (I:H) with minor availability (A:L) and no confidentiality loss.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
5DescriptionCVE.org
Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in unauthorized migration operations.
Executive ViewAI
Wekan project management platform versions before 8.20 contain a flaw allowing regular users to perform administrator-level operations. No public exploit has been identified at time of analysis, but this privilege escalation poses significant risk to data integrity and governance in organizations relying on Wekan for collaborative project management.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by t
OS command injection in Wekan (the open-source Meteor-based kanban board) before version 9.07 lets an authenticated user
Authentication bypass in Wekan (open-source Meteor kanban) before version 9.46 lets an unauthenticated attacker imperson
A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticate
Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scrip
Account takeover in Wekan (open-source Meteor kanban) before 9.32 allows an attacker who controls an OIDC provider accou
Privilege escalation in Wekan open-source kanban (all versions prior to 9.89, dubbed 'SortBleed') allows any board membe
Privilege escalation in the self-hosted Wekan kanban board through version 18.15 allows any authenticated user to rewrit
Stored XSS in Wekan prior to v9.90 allows authenticated board members to upload HTML containing JavaScript disguised as
LDAP filter injection in WeKan before 8.19 allows remote unauthenticated attackers to manipulate LDAP search filters and
Privilege escalation in WeKan (versions prior to 8.35) allows authenticated board members with low privileges to perform
Wekan's outgoing webhook URL validator in versions 8.36 through 9.73 allows authenticated board members to bypass SSRF p
Exploit-DB