CVE-2026-25563highCWE-639

CVE-2026-25563: high-severity vulnerability in WeKan

WeKan < 8.19 Checklist Creation Cross-Board IDOR

Published · Updated

Follow this CVE+ Monitor WeKan

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.3%
WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not verify that the supplied cardId belongs to the supplied boardId, allowing cross-board ID tampering by manipulating identifiers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
WeKan · WeKan
Related CVEs — WeKan

In the same product, most dangerous first.

CVE-2026-25560HIGHWeKan < 8.19 LDAP Authentication Filter InjectionEPSS 0.7%CVE-2026-25859HIGHWeKan < 8.20 Migration Functionality Insufficient Permission ChecksEPSS 0.4%CVE-2026-25562MEDIUMWeKan < 8.19 Attachments Publication Information DisclosureEPSS 0.3%CVE-2026-25561HIGHWeKan < 8.19 Attachment Upload Object Relationship Validation BypassEPSS 0.3%CVE-2026-25564HIGHWeKan < 8.19 Checklist Deletion IDOR via Missing Relationship ValidationEPSS 0.3%CVE-2026-25565HIGHWeKan < 8.19 Read-only Board Roles Can Update CardsEPSS 0.3%