Vulnerabilities

TI-2026-20675 CVE-2026-25568 · GHSA-mxjf-259r-3r76

WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass

LOW 31

WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforced at board creation time.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00225 Published 2026-02-07 Fixed in 8.19 CWE-863

TI-2026-20674 CVE-2026-25567 · GHSA-9w3f-qqh3-w7fc

WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId

LOW 24

WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00273 Published 2026-02-07 Fixed in 8.19 CWE-639

TI-2026-20673 CVE-2026-25566 · GHSA-62j7-j842-x6r6

WeKan < 8.19 Cross-board Card Move Without Destination Authorization

LOW 31

WeKan versions prior to 8.19 contain an authorization vulnerability in card move logic.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00247 Published 2026-02-07 Fixed in 8.19 CWE-863

TI-2026-20672 CVE-2026-25565 · GHSA-7c8j-xhpq-ww8c

WeKan < 8.19 Read-only Board Roles Can Update Cards

LOW 31

WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring write permission.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00307 Published 2026-02-07 Fixed in 8.19 CWE-863

TI-2026-20671 CVE-2026-25564 · GHSA-xc4h-36v7-xrrw

WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation

LOW 31

WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00311 Published 2026-02-07 Fixed in 8.19 CWE-639

TI-2026-20670 CVE-2026-25563 · GHSA-x9cj-242h-gr3m

WeKan < 8.19 Checklist Creation Cross-Board IDOR

LOW 31

WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00314 Published 2026-02-07 Fixed in 8.19 CWE-639

TI-2026-20669 CVE-2026-25562 · GHSA-4h56-xmq8-7hc9

WeKan < 8.19 Attachments Publication Information Disclosure

LOW 30

WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00321 Published 2026-02-07 Fixed in 8.19 CWE-203

TI-2026-20668 CVE-2026-25561 · GHSA-5q4r-452w-ggwq

WeKan < 8.19 Attachment Upload Object Relationship Validation Bypass

LOW 33

WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00314 Published 2026-02-07 Fixed in 8.19 CWE-863

TI-2026-20667 CVE-2026-25560 · GHSA-gmrw-vh4q-4fvv

WeKan < 8.19 LDAP Authentication Filter Injection

MEDIUM 47

WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00732 Published 2026-02-07 Fixed in 8.19 CWE-90

Vulnerabilities

Filters