CVE-2026-25566: Wekan Project Wekan

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

WeKan versions prior to 8.19 contain an authorization vulnerability in card move logic. A user can specify a destination board/list/swimlane without adequate authorization checks for the destination and without validating that destination objects belong to the destination board, potentially enabling unauthorized cross-board moves.

Affected products

• Wekan Project Wekan: before 8.19 (fixed in 8.19)

Published 2026-02-07. Last modified 2026-07-14.