CVE-2026-25565— WeKan < 8.19 Read-only Board Roles Can Update Cards
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-25565
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WeKan < 8.19 Read-only Board Roles Can Update Cards
Source: NVD (National Vulnerability Database)
Vulnerability Description
WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring write permission. This can allow users with read-only roles to perform card updates that should require write access.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不正确
Source: NVD (National Vulnerability Database)
Vulnerability Title
WeKan 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WeKan是WeKan开源的一个看板应用程序。 WeKan 8.19之前版本存在安全漏洞，该漏洞源于某些卡片更新API路径仅验证看板读取权限而非要求写入权限，可能导致具有只读角色的用户执行需要写入权限的卡片更新。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-25565
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-25565
请登录查看更多情报信息。
Same Patch Batch · WeKan · 2026-02-07 · 10 CVEs total
| CVE-2026-25567 | WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId | |
| CVE-2026-25561 | WeKan < 8.19 Attachment Upload Object Relationship Validation Bypass | |
| CVE-2026-25568 | WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass | |
| CVE-2026-25564 | WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation | |
| CVE-2026-25562 | WeKan < 8.19 Attachments Publication Information Disclosure | |
| CVE-2026-25560 | WeKan < 8.19 LDAP Authentication Filter Injection | |
| CVE-2026-25563 | WeKan < 8.19 Checklist Creation Cross-Board IDOR | |
| CVE-2026-25566 | WeKan < 8.19 Cross-board Card Move Without Destination Authorization | |
| CVE-2026-25859 | WeKan < 8.20 Migration Functionality Insufficient Permission Checks |
IV. Related Vulnerabilities
Same product: WeKan
- CVE-2026-41455
WeKan < 8.35 SSRF via Webhook URL - CVE-2026-41454
WeKan < 8.35 Missing Authorization via Integration REST API - CVE-2026-30847
Wekan Credential Leak via notificationUsers Publication Expo - CVE-2026-30846
Wekan Exposes All Global Webhook Integrations through global - CVE-2026-30845
Wekan Exposes Sensitive Data through Lack of Field Filtering
Same vendor: WeKan
- CVE-2026-41455
WeKan < 8.35 SSRF via Webhook URL - CVE-2026-41454
WeKan < 8.35 Missing Authorization via Integration REST API - CVE-2026-30847
Wekan Credential Leak via notificationUsers Publication Expo - CVE-2026-30846
Wekan Exposes All Global Webhook Integrations through global - CVE-2026-30845
Wekan Exposes Sensitive Data through Lack of Field Filtering
Same weakness: CWE-863
- CVE-2026-42571
Privilege Escalation Attack affecting Pelican Web UI - CVE-2025-15633
HCL BigFix WebUI is affected by an improper authorization vu - CVE-2026-42296
Argo Workflows has incomplete fix for CVE-2026-31892: hostNe - CVE-2025-66170
Apache CloudStack: Any user can list backups that they shoul - CVE-2026-41903
FreeScout IDOR Vulnerability: PERM_EDIT_USERS allows modifyi
V. Comments for CVE-2026-25565
No comments yet