1. Home
  2. CVE Database
  3. CVE-2026-25565
MEDIUM · 6.5

CVE-2026-25565

WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring write permission. This can allow users wit...

Vulnerability Description

WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring write permission. This can allow users with read-only roles to perform card updates that should require write access.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
Wekan ProjectWekan< 8.19

Related Weaknesses (CWE)

CWE-863

References

FAQ

What is CVE-2026-25565?

CVE-2026-25565 is a vulnerability with a CVSS score of 6.5 (MEDIUM). WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring write permission. This can allow users wit...

How severe is CVE-2026-25565?

CVE-2026-25565 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-25565?

Check the references section above for vendor advisories and patch information. Affected products include: Wekan Project Wekan.