CVE-2026-25564: Wekan Project Wekan

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not verify that the supplied cardId belongs to the supplied boardId, allowing cross-board ID tampering by manipulating identifiers.

Affected products

• Wekan Project Wekan: before 8.19 (fixed in 8.19)

Published 2026-02-07. Last modified 2026-07-14.