CVE-2026-25562: WeKan < 8.19 Attachments Publication Information Disclosure
WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication. Attachment metadata can be returned without properly scoping results to boards and cards accessible to the requesting user, potentially exposing attachment metadata to unauthorized users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeKanto a version that resolves this vulnerability.Fixed in 8.19
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25562?
CVE-2026-25562 is considered a high-severity information disclosure vulnerability.
How do I fix CVE-2026-25562?
To fix CVE-2026-25562, upgrade to WeKan version 8.19 or later.
What type of vulnerability is CVE-2026-25562?
CVE-2026-25562 is an information disclosure vulnerability affecting WeKan.
What can be exposed due to CVE-2026-25562?
CVE-2026-25562 may expose attachment metadata that should not be accessible to unauthorized users.
Which versions of WeKan are affected by CVE-2026-25562?
WeKan versions before 8.19 are affected by CVE-2026-25562.