Vulnerability · Published Feb 7, 2026 · Assigned by VulnCheck

CVE-2026-25565WeKan < 8.19 Read-only Board Roles Can Update Cards

High 7.1

In plain English

A high-severity incorrect authorization in WeKan from WeKan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.3%top 76.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring write permission. This can allow users with read-only roles to perform card updates that should require write access.

Affected products (as reported)

Vendor	Product	Versions
WeKan	WeKan	0 – before 8.19

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/wekan/wekan/commit/181f837d8cbae96bdf9dcbd31beaa3653c2c0285 patch
https://wekan.fi/ product
https://www.vulncheck.com/advisories/wekan-read-only-board-roles-can-update-cards third-party-advisory