WeKan EUVD-2026-25117

Exploitation requires authenticated access to WeKan as a board member with low-level privileges (PR:L in CVSS vector). The vulnerability affects boards utilizing the Integration REST API feature for webhooks, Slack, or other external service connections. No special configuration beyond having integrations enabled is necessary. Exploitation succeeds against default WeKan deployments where integration functionality is active. Attack is remotely exploitable over network (AV:N) with low complexity (AC:L) and no user interaction required (UI:N). Limiting factor: attacker must possess valid credentials to any board in the WeKan instance, though these can be standard member-level accounts rather than administrator accounts. Organizations not using WeKan integrations or those with single-user boards face reduced practical risk despite technical vulnerability presence.

Real-world risk is HIGH for organizations using WeKan with multiple board members at different privilege levels. CVSS 8.7 accurately reflects the technical severity: network-accessible (AV:N), low complexity (AC:L), requiring only low-privilege authentication (PR:L) with no user interaction (UI:N). Any authenticated board member can escalate to administrative integration control. EPSS score unavailable, but exploitation does not require specialized skills - standard API requests suffice. Not listed in CISA KEV, indicating no confirmed widespread exploitation. No public POC identified, but the attack is straightforward for anyone with API knowledge and valid credentials. The attack is automatable once credentials are obtained, enabling programmatic enumeration and manipulation of integrations. Primary risk: insider threats, compromised low-privilege accounts, or malicious board members exfiltrating webhook secrets, disrupting integrations, or establishing persistence through unauthorized webhooks. Organizations with external collaborators on boards face elevated risk. Patch availability since version 8.35 significantly reduces risk for maintained deployments, but unmaintained instances remain vulnerable.

A malicious board member with standard (non-admin) credentials authenticates to WeKan and sends crafted HTTP requests directly to the Integration REST API endpoints. Without proper authorization validation, the attacker enumerates all board integrations including webhook URLs containing authentication tokens or API keys. The attacker then creates a new webhook integration pointing to an attacker-controlled server to exfiltrate board data in real-time, modifies existing Slack integrations to redirect notifications, or deletes critical CI/CD pipeline integrations to disrupt operations. The attack requires only network access to the WeKan instance and valid low-privilege credentials, with no complex exploitation techniques needed.