CVE-2026-25567: WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId
WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API. The endpoint accepts an authorId from the request body, allowing an authenticated user to spoof the recorded comment author by supplying another user's identifier.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeKanto a version that resolves this vulnerability.Fixed in 8.19 - Configuration
Update/adjust the card comment creation endpoint so the comment author recorded in storage is taken from the authenticated user context rather than the user-controlled authorId field in the request body.
WeKan card comment creation API authorId handling = Ignore request body authorId and set comment author based on the authenticated user - Compensating control
Restrict access to the card comment creation API so authenticated users cannot submit arbitrary authorId values (e.g., enforce server-side that the recorded comment author is derived from the authenticated session, not from request body authorId).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25567?
CVE-2026-25567 is classified as a medium severity vulnerability due to its potential for author spoofing.
How do I fix CVE-2026-25567?
To fix CVE-2026-25567, upgrade to WeKan version 8.19 or later where the vulnerability has been addressed.
What impact does CVE-2026-25567 have on WeKan users?
CVE-2026-25567 allows authenticated users to spoof the author of card comments, potentially misleading other users.
In which versions of WeKan is CVE-2026-25567 present?
CVE-2026-25567 affects all WeKan versions prior to 8.19.
What is the nature of the vulnerability described in CVE-2026-25567?
CVE-2026-25567 involves an insecure direct object reference (IDOR) in the card comment creation API.