HIGH🇵🇱 Wersja polska

CVE-2026-25561

CVSS 7.1v4.0pub. 2026-02-07upd. 2026-02-10

WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API. The API does not fully validate that provided identifiers (such as boardId, cardId, swimlaneId, and listId) are consistent and refer to a coherent card/board relationship, enabling attempts to upload attachments with mismatched object relationships.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Wekan Project Wekan

    APP
    Wekan Project
    < 8.19
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-30844CRITICAL9.3PL ✓ten sam produkt

SSRF w Wekan — nieautoryzowany dostęp do wewnętrznych zasobów sieciowych

CVE-2026-30847CRITICAL9.3PL ✓ten sam produkt

Wekan: ujawnienie wrażliwych danych użytkowników przez publikację notificationUsers

CVE-2026-30843CRITICAL9.3PL ✓ten sam produkt

Wekan IDOR: nieautoryzowana modyfikacja pól własnych na tablicach

CVE-2026-30846HIGH8.7ten sam produkt

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the globalwebhooks pub...

CVE-2026-25565HIGH7.1ten sam produkt

WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths valida...