Vulnerabilidades de Wekan

CVE-2026-25859 Alta · 8.8 CWE-863 07/02/2026

WeKan < 8.20 Migration Functionality Insufficient Permission Checks

Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in unauthorized migration operations.

CVE-2026-25568 Média · 4.3 CWE-863 07/02/2026

WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass

WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforced at board creation time. When allowPrivateOnly is enabled, users can still create public boards due to incomplete server-side enforcement.

CVE-2026-25567 Média · 4.3 CWE-639 07/02/2026

WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId

WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API. The endpoint accepts an authorId from the request body, allowing an authenticated user to spoof the recorded comment author by supplying another user's identifier.

CVE-2026-25566 Média · 5.4 CWE-863 07/02/2026

WeKan < 8.19 Cross-board Card Move Without Destination Authorization

WeKan versions prior to 8.19 contain an authorization vulnerability in card move logic. A user can specify a destination board/list/swimlane without adequate authorization checks for the destination and without validating that destination objects belong to the destination board, potentially enabling unauthorized cross-board moves.

CVE-2026-25565 Média · 6.5 CWE-863 07/02/2026

WeKan < 8.19 Read-only Board Roles Can Update Cards

WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring write permission. This can allow users with read-only roles to perform card updates that should require write access.

CVE-2026-25564 Alta · 7.5 CWE-639 07/02/2026

WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation

WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not verify that the supplied cardId belongs to the supplied boardId, allowing cross-board ID tampering by manipulating identifiers.

CVE-2026-25563 Alta · 7.5 CWE-639 07/02/2026

WeKan < 8.19 Checklist Creation Cross-Board IDOR

WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not verify that the supplied cardId belongs to the supplied boardId, allowing cross-board ID tampering by manipulating identifiers.

CVE-2026-25562 Média · 4.3 CWE-203 07/02/2026

WeKan < 8.19 Attachments Publication Information Disclosure

WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication. Attachment metadata can be returned without properly scoping results to boards and cards accessible to the requesting user, potentially exposing attachment metadata to unauthorized users.

CVE-2026-25561 Alta · 7.5 CWE-863 07/02/2026

WeKan < 8.19 Attachment Upload Object Relationship Validation Bypass

WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API. The API does not fully validate that provided identifiers (such as boardId, cardId, swimlaneId, and listId) are consistent and refer to a coherent card/board relationship, enabling attempts to upload attachments with mismatched object relationships.

CVE-2026-25560 Crítica · 9.8 CWE-90 07/02/2026

Injeção de filtro LDAP na autenticação LDAP do WeKan (CVE-2026-25560)

As versões do WeKan anteriores à 8.19 contêm uma vulnerabilidade de injeção de filtro LDAP na autenticação LDAP. A entrada de nome de usuário fornecida pelo usuário é incorporada a filtros de busca LDAP e a valores relacionados a DN sem escape adequado, permitindo que um atacante manipule consultas LDAP durante a autenticação.