CVE-2025-65782

Katalog CVE

CVSS 6.5 · Medium EPSS 0,26%

Kerentanan Improper Authorization pada wekan project wekan. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authorization flaw in card update handling allows board members (and potentially other authenticated users) to add/remove arbitrary user IDs in vote.positive / vote.negative arrays, enabling vote forgery and unauthorized voting.

Rincian

Terbit di NVD

15 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wekan.fi/hall-of-fame/spacebleed/ advisory vendor
• https://github.com/wekan/wekan/commit/0a1a075f3153e71d9a858576f1c68d2925230d9c patch
• https://github.com/wekan/wekan product
• https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release release notes