CVE-2026-25563: WeKan < 8.19 Checklist Creation Cross-Board IDOR
WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not verify that the supplied cardId belongs to the supplied boardId, allowing cross-board ID tampering by manipulating identifiers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeKanto a version that resolves this vulnerability.Fixed in 8.19
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25563?
CVE-2026-25563 is considered a moderate severity vulnerability due to its potential for unauthorized access across boards.
How do I fix CVE-2026-25563?
To fix CVE-2026-25563, upgrade WeKan to version 8.19 or later where the issue has been addressed.
What kind of vulnerability is CVE-2026-25563?
CVE-2026-25563 is an insecure direct object reference (IDOR) vulnerability affecting checklist creation in WeKan.
What are the implications of CVE-2026-25563?
The implications of CVE-2026-25563 include the risk of users being able to manipulate IDs to access checklists from different boards.
Which versions of WeKan are affected by CVE-2026-25563?
WeKan versions prior to 8.19 are affected by CVE-2026-25563 and should be updated to mitigate the vulnerability.