VULNERABILITY INTELLIGENCE

CVE-2026-25568

CVSS score4.3 MEDIUM
EPSS probability0.22%
CISA KEVNot currently listed
Published2026-02-07
Last modified2026-07-14
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforced at board creation time. When allowPrivateOnly is enabled, users can still create public boards due to incomplete server-side enforcement.

Weakness classification

  • disclosure@vulncheck.com: CWE-863

Primary references