CVE Intelligence
Analysis AI-assisted

CVE-2026-25560: WeKan LDAP Filter Injection in LDAP Authentication

WeKan versions before 8.19 contain an LDAP filter injection flaw (CWE-90) in LDAP authentication, where username input is not adequately escaped before use in search filters and DN-related values. NVD rates it 9.8 under CVSS 3.1 (critical), and VulnCheck rates it 8.7 under CVSS 4.0. The record does not list the CVE in CISA KEV, so no confirmed exploitation appears in the sources consulted, but administrators should review the affected range and the referenced patch.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

WeKan versions prior to 8.19 contain an LDAP filter injection flaw (CWE-90) in the LDAP authentication feature. According to the record, username input is placed into LDAP search filters and DN-related values without adequate escaping. The NVD entry and the VulnCheck advisory describe the issue, and a patch commit is listed in the WeKan repository.

Impact

  • Manipulated LDAP queries during login could affect which directory entries are matched during authentication.
  • NVD scores the issue 9.8 under CVSS 3.1, with high confidentiality, integrity and availability impact and no privileges or user interaction required.
  • VulnCheck scores the issue 8.7 under CVSS 4.0.

Affected products and versions

  • Wekan Project Wekan: versions before 8.19, recorded as the range below 8.19.
  • The record does not list intermediate versions or a separate fixed-version statement.

Exploitation status

  • The CVE is not listed in the CISA KEV catalog in the record.
  • No confirmed exploitation appears in the sources consulted.
  • The record gives an EPSS probability of 0.00971 and a percentile of 0.60941.

Remediation and mitigation

  • Upgrade WeKan to version 8.19 or later. The affected range implies that 8.19 is not vulnerable, so confirm this against the release notes before rollout.
  • Review the referenced patch commit to understand the change.
  • Until the upgrade is complete, limit exposure of the login interface where practical and review the permissions of the LDAP service account used by WeKan.

Detection guidance

  • Review authentication logs for unusual username values containing LDAP special characters or abnormal login failure patterns.
  • Monitor directory server logs for search requests originating from the WeKan server that have unexpected structure or volume.

Limitations of the available information

  • The record does not name the vulnerable code paths, the exact technical preconditions, or whether other authentication methods are affected.
  • The record does not state a fixed version in explicit text; the 8.19 boundary is inferred from the affected range and the patch reference.
  • The EPSS date in the record (2026-10-13) is later than the publication date, so it should be treated with caution.

Frequently asked questions

Which WeKan versions are affected by CVE-2026-25560?

The record lists WeKan versions before 8.19 as affected. Intermediate versions are not listed, so check the release notes for your deployed build.

Is this vulnerability known to be actively exploited?

The record does not list the CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do first?

Identify WeKan instances below 8.19, plan an upgrade, review the referenced patch commit, and check the permissions of the LDAP service account used by WeKan.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.