CVE-2026-25561

Katalog CVE

CVSS 7.5 · High EPSS 0,45%

Kerentanan Incorrect Authorization pada wekan project wekan. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API. The API does not fully validate that provided identifiers (such as boardId, cardId, swimlaneId, and listId) are consistent and refer to a coherent card/board relationship, enabling attempts to upload attachments with mismatched object relationships.

Rincian

Terbit di NVD

7 Februari 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wekan/wekan/commit/1d16955b6d4f0a0282e89c2c1b0415c7597019b8 patch
• https://www.vulncheck.com/advisories/wekan-attachment-upload-object-relationship-validation-bypass advisory pihak ketiga
• https://wekan.fi/ product