Vulnerability Description
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to missing server-side authorization checks; this enables privilege escalation and unauthorized access to other teams/orgs.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wekan Project | Wekan | < 8.16 |
Related Weaknesses (CWE)
References
- https://github.com/wekan/wekanProduct
- https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--relRelease Notes
- https://github.com/wekan/wekan/commit/f26d58201855e861bab1cd1fda4d62c664efdb81Patch
- https://wekan.fi/hall-of-fame/spacebleed/Vendor Advisory
FAQ
What is CVE-2025-65780?
CVE-2025-65780 is a vulnerability with a CVSS score of 8.8 (HIGH). An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including o...
How severe is CVE-2025-65780?
CVE-2025-65780 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-65780?
Check the references section above for vendor advisories and patch information. Affected products include: Wekan Project Wekan.