CVE-2026-25564

High CVSS: 7.1

WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not verify that the supplied cardId belongs to the supplied boardId, allowing cross-board ID tampering by manipulating identifiers.

Vendor

Wekan Project

Product

Wekan

CWE

CWE-639

Yayın Tarihi

2026-02-07 22:16:01

Güncelleme

2026-02-10 21:58:59

Source Identifier

disclosure@vulncheck.com

KEV Date Added

Kategoriler

CWE-639 Wekan HIGH Wekan Project 2026

Referanslar

https://github.com/wekan/wekan/commit/08a6f084eba09487743a7c807fb4a9000fcfa9ac https://wekan.fi/ https://www.vulncheck.com/advisories/wekan-checklist-deletion-idor-via-missing-relationship-validation

Benzer Kayıtlar

Critical

CVE-2026-30844

Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 are vulnerable to Server-Side Request Forg…

Medium

CVE-2026-30845

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the board composite publication…

High

CVE-2026-30846

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the globalwebhooks publication e…

Critical

CVE-2026-30847

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the notificationUsers publicatio…

Critical

CVE-2026-30843

Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 have a critical Insecure Direct Object Ref…

Medium

CVE-2026-2207

A weakness has been identified in WeKan up to 8.20. This issue affects some unknown processing of the file server/public…