VULNERABILITY INTELLIGENCE

CVE-2026-25565

CVSS score6.5 MEDIUM
EPSS probability0.31%
CISA KEVNot currently listed
Published2026-02-07
Last modified2026-07-14
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Description

WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring write permission. This can allow users with read-only roles to perform card updates that should require write access.

Weakness classification

  • disclosure@vulncheck.com: CWE-863

Primary references