CVE-2026-25562mediumCWE-203

CVE-2026-25562: medium-severity vulnerability in WeKan

WeKan < 8.19 Attachments Publication Information Disclosure

Published · Updated

Follow this CVE+ Monitor WeKan

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%
WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication. Attachment metadata can be returned without properly scoping results to boards and cards accessible to the requesting user, potentially exposing attachment metadata to unauthorized users.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
WeKan · WeKan
Related CVEs — WeKan

In the same product, most dangerous first.

CVE-2026-25560HIGHWeKan < 8.19 LDAP Authentication Filter InjectionEPSS 0.7%CVE-2026-25859HIGHWeKan < 8.20 Migration Functionality Insufficient Permission ChecksEPSS 0.4%CVE-2026-25563HIGHWeKan < 8.19 Checklist Creation Cross-Board IDOREPSS 0.3%CVE-2026-25561HIGHWeKan < 8.19 Attachment Upload Object Relationship Validation BypassEPSS 0.3%CVE-2026-25564HIGHWeKan < 8.19 Checklist Deletion IDOR via Missing Relationship ValidationEPSS 0.3%CVE-2026-25565HIGHWeKan < 8.19 Read-only Board Roles Can Update CardsEPSS 0.3%