CVE-2025-65780: High severity Wekan Wekan vulnerability

Q: What is the severity of CVE-2025-65780?

CVE-2025-65780 is categorized as a medium severity vulnerability due to its potential impact on user privileges.

Q: How do I fix CVE-2025-65780?

To fix CVE-2025-65780, upgrade your Wekan installation to version 18.16 or later.

Q: Who is affected by CVE-2025-65780?

CVE-2025-65780 affects all authenticated users of Wekan versions up to 18.15.

Q: What type of vulnerability is CVE-2025-65780?

CVE-2025-65780 is an authorization vulnerability that allows users to improperly update user documents.

Q: When was CVE-2025-65780 disclosed?

CVE-2025-65780 was disclosed in version 18.16, released on November 2, 2025.

Published Dec 15, 2025

Updated

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to missing server-side authorization checks; this enables privilege escalation and unauthorized access to other teams/orgs.

Affected Software

2 affected components

Wekan Wekan<=18.15

Wekan project Wekan<8.16

Remediation

Patch Available

https://github.com/wekan/wekan/commit/f26d58201855e861bab1cd1fda4d62c664efdb81

Event History

Dec 15, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·02:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-65780?

CVE-2025-65780 is categorized as a medium severity vulnerability due to its potential impact on user privileges.

How do I fix CVE-2025-65780?