CVE-2025-65781

Katalog CVE

CVSS 8.2 · High EPSS 0,34%

Kerentanan Improper Authentication pada wekan project wekan. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer value as a userId and enters a non-terminating body-handling branch for any non-empty bearer token, enabling trivial application-layer DoS and latent identity-spoofing.

Rincian

Terbit di NVD

15 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wekan.fi/hall-of-fame/spacebleed/ advisory vendor
• https://github.com/wekan/wekan/commit/ccd90343394f433b287733ad0a33c08e0a71f53c patch
• https://github.com/wekan/wekan product
• https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release release notes